Chrome · V8
CVE-2026-14405
Uninitialized Memory in V8
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchsrc/base/bounded-page-allocator.cc |
modified |
Files Changed
src/base/bounded-page-allocator.cc
Patch
From 5a2bdebda1f4a376af6d9a629d5bbe63026a9bb2 Mon Sep 17 00:00:00 2001 From: Michael Lippautz <[email protected]> Date: Fri, 15 May 2026 10:56:59 +0000 Subject: [PATCH] [base] Fix potential stale memory With kAllocatedPagesMustBeZeroInitialized we must crash in case the OS runs out of VMAs to create. Fixed: 513376037 Change-Id: I2534e33ad98c3e06a1ff63507f86600f8c3e2824 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7849375 Reviewed-by: Igor Sheludko <[email protected]> Auto-Submit: Michael Lippautz <[email protected]> Commit-Queue: Igor Sheludko <[email protected]> Cr-Commit-Position: refs/heads/main@{#107342} --- diff --git a/src/base/bounded-page-allocator.cc b/src/base/bounded-page-allocator.cc index de53e0d..5e273cf 100644 --- a/src/base/bounded-page-allocator.cc +++ b/src/base/bounded-page-allocator.cc @@ -213,6 +213,9 @@ // When we are required to return zero-initialized pages, we decommit the // pages here, which will cause any wired pages to be removed by the OS. success = page_allocator_->DecommitPages(raw_address, size); + // Since we require zero-initialized pages, we must fail here if we cannot + // decomitt the range. + CHECK(success); } else { switch (page_freeing_mode_) { case PageFreeingMode::kMakeInaccessible:
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page