Chrome · V8
CVE-2026-14405
Uninitialized Memory in V8
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchsrc/base/bounded-page-allocator.cc |
modified |
Files Changed
src/base/bounded-page-allocator.cc
Patch
From 5a2bdebda1f4a376af6d9a629d5bbe63026a9bb2 Mon Sep 17 00:00:00 2001
From: Michael Lippautz <mlippautz@chromium.org>
Date: Fri, 15 May 2026 10:56:59 +0000
Subject: [PATCH] [base] Fix potential stale memory
With kAllocatedPagesMustBeZeroInitialized we must crash in case the OS
runs out of VMAs to create.
Fixed: 513376037
Change-Id: I2534e33ad98c3e06a1ff63507f86600f8c3e2824
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7849375
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107342}
---
diff --git a/src/base/bounded-page-allocator.cc b/src/base/bounded-page-allocator.cc
index de53e0d..5e273cf 100644
--- a/src/base/bounded-page-allocator.cc
+++ b/src/base/bounded-page-allocator.cc
@@ -213,6 +213,9 @@
// When we are required to return zero-initialized pages, we decommit the
// pages here, which will cause any wired pages to be removed by the OS.
success = page_allocator_->DecommitPages(raw_address, size);
+ // Since we require zero-initialized pages, we must fail here if we cannot
+ // decomitt the range.
+ CHECK(success);
} else {
switch (page_freeing_mode_) {
case PageFreeingMode::kMakeInaccessible:
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page