Towards Better Semantics Exploration for Browser Fuzzing
summary
SaGe automatically extracts a CFG from W3C specs, refines it with browser-execution feedback into a production-context sensitive grammar so the fuzzer avoids semantically invalid productions, and then generates HTML/CSS/JS cases. Twenty-four hour campaigns on Chrome, Safari and Firefox show a 6–277% edge-coverage lift, a 3.6–162% increase in semantic-correctness rate, and twice as many bugs as prior tools; the evaluation finds 62 bugs (40 confirmed, including 10 CVEs) with little runtime overhead.
AI-written summary · about
chapters (11)
- 0:00Browser fuzzing research intro
- 0:23Study motivation and goals
- 1:08Limitations of current fuzzers
- 3:19Handwritten grammar issues
- 4:47Key insight and objectives
- 5:30System design overview
- 6:13Grammar extraction from W3C
- 8:43Semantic inference and context
- 11:35Context checking function
- 13:27Experimental results
- 14:14Q&A
related talks
52mStructure aware fuzzing
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
27mAttacking the WebAssembly Compiler of WebKit
01h 15mMake your programs more reliable with Fuzzing
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing
53mThree Colours of Fuzzing: Reflections and Open Challenges
15mSqueezing Juicy Variant Bugs Out of Modern Browsers
31mD1T1 - Fuzzing Javascript Engines for Fun and Pwnage