Low chrome Uninitialized Memory 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUninitialized Use in Dawn
DescriptionUninitialized Use in Dawn
ComponentDawn
Bug ClassUninitialized Memory
Tracker515437522
Fix commit11e4d46e28ba (dawn) +3/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Files Changed

  • src/dawn/wire/ChunkedCommandSerializer.h
From 11e4d46e28ba6123785e1809b26f66e37f9aa532 Mon Sep 17 00:00:00 2001
From: Kai Ninomiya <[email protected]>
Date: Tue, 02 Jun 2026 17:21:47 -0700
Subject: [PATCH] [dawn][wire] Zero-init ChunkedCommandSerializer space

Fixed: 515437522
Change-Id: Ia97bf8e68a7612428634c1187f67af96fa899ebf
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/312015
Auto-Submit: Kai Ninomiya <[email protected]>
Reviewed-by: Loko Kung <[email protected]>
Commit-Queue: Kai Ninomiya <[email protected]>
---

diff --git a/src/dawn/wire/ChunkedCommandSerializer.h b/src/dawn/wire/ChunkedCommandSerializer.h
index 67e4fc7..cac63cb 100644
--- a/src/dawn/wire/ChunkedCommandSerializer.h
+++ b/src/dawn/wire/ChunkedCommandSerializer.h
@@ -135,7 +135,9 @@
             return;
         }
 
-        auto cmdSpace = std::unique_ptr<char[]>(new char[requiredSize]);
+        // Allocate as zero-initialized because padding won't get initialized during command
+        // serialization (and this whole buffer is sent raw to the other end of the wire).
+        auto cmdSpace = std::unique_ptr<char[]>(new char[requiredSize]{});
 
         SerializeBuffer serializeBuffer(cmdSpace.get(), requiredSize);
         WireResult rCmd = SerializeCmd(cmd, requiredSize, &serializeBuffer);
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.