Low chrome Uninitialized Memory 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUninitialized Use in V8
DescriptionUninitialized Use in V8
ComponentV8
Bug ClassUninitialized Memory
Tracker513376037
Fix commit5a2bdebda1f4 (v8/v8) +3/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Changed Functions

FunctionChangeNotes
switch
src/base/bounded-page-allocator.cc
modified

Files Changed

  • src/base/bounded-page-allocator.cc
From 5a2bdebda1f4a376af6d9a629d5bbe63026a9bb2 Mon Sep 17 00:00:00 2001
From: Michael Lippautz <mlippautz@chromium.org>
Date: Fri, 15 May 2026 10:56:59 +0000
Subject: [PATCH] [base] Fix potential stale memory

With kAllocatedPagesMustBeZeroInitialized we must crash in case the OS
runs out of VMAs to create.

Fixed: 513376037
Change-Id: I2534e33ad98c3e06a1ff63507f86600f8c3e2824
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7849375
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107342}
---

diff --git a/src/base/bounded-page-allocator.cc b/src/base/bounded-page-allocator.cc
index de53e0d..5e273cf 100644
--- a/src/base/bounded-page-allocator.cc
+++ b/src/base/bounded-page-allocator.cc
@@ -213,6 +213,9 @@
     // When we are required to return zero-initialized pages, we decommit the
     // pages here, which will cause any wired pages to be removed by the OS.
     success = page_allocator_->DecommitPages(raw_address, size);
+    // Since we require zero-initialized pages, we must fail here if we cannot
+    // decomitt the range.
+    CHECK(success);
   } else {
     switch (page_freeing_mode_) {
       case PageFreeingMode::kMakeInaccessible:
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.