If you have a variable set with sensitive data:
var secretPassword = \'myPa$sW0rd\';
and you overwrite it:
secretPassword = \'0
Does a javascript engine allocate new memory for the new data?
yes
is the data myPa$sW0rd potentially somewhere in unallocated memory still?
yes if no garbage collection cleaned it up
My main question is this: is there a way to guarantee that you overwrite the data? (ie zero it out or securely delete the data).
Not really, except if you play with the garbage collector. See related post
I wonder if looping through the characters in the string and resetting them that way would do it.
No
Edit : As pointed out by doldt, there is no real security threat even if the previous data is still somewhere in memory.