Cloudflare CEO Matthew Prince says vulnerability was triggered more than 1.2m times from 6,500 sites. He says the company is working with Google and others to remove all leaked data from memory. Cloudbleed was triggered when a page with two characteristics was requested through the network. The two characteristics were: The HTML on the page needed to be broken in a specific way; and a particular set of Cloud flare features were turned on for the page in question. The bug caused the parser, when it encountered unterminated attribute at the end of a page, to not stop reading from adjacent memory.”]
Source: https://nakedsecurity.sophos.com/2017/03/02/cloudflare-chief-pledges-third-party-review-of-code/