diff --git a/services/network/chunked_data_pipe_upload_data_stream.cc b/services/network/chunked_data_pipe_upload_data_stream.cc
--- a/services/network/chunked_data_pipe_upload_data_stream.cc
+++ b/services/network/chunked_data_pipe_upload_data_stream.cc
@@ -175,6 +175,16 @@ void ChunkedDataPipeUploadDataStream::OnSizeReceived(int32_t status,
   DCHECK(!size_);
   DCHECK_EQ(net::OK, status_);

+  // SECURITY: |status| comes from the renderer (via the ChunkedDataPipeGetter
+  // mojom reply, which declares it as raw int32). It must be either net::OK
+  // (0) or a negative net::Error. A positive value would be passed unchanged
+  // to OnReadCompleted() below, where the HTTP stack interprets it as a byte
+  // count and reads that many bytes from a never-written IOBuffer
+  // (HeapArray::Uninit), exfiltrating uninitialized network-process heap to
+  // the attacker's server. Clamp positive values to ERR_FAILED.
+  if (status > 0) {
+    status = net::ERR_FAILED;
+  }
   status_ = status;
   if (status == net::OK) {
     size_ = size;