From Coverage to Causes: Data-Centric Fuzzing for JavaScript Engines

2025-12-19 · Kishan Kumar Ganguly, Tim Menzies arxiv

Context: Exhaustive fuzzing of modern JavaScript engines is infeasible due to the vast number of program states and execution paths. Coverage-guided fuzzers waste effort on low-risk inputs, often ignoring vulnerability-triggering ones that do not increase coverage. Existing heuristics proposed to mitigate this require expert effort, are brittle, and hard to adapt. Objective: We propose a data-centric, LLM-boosted alternative that learns from historical vulnerabilities to automatically identify minimal static (code) and dynamic (runtime) features for detecting high-risk inputs. Method: Guided by historical V8 bugs, iterative prompting generated 115 static and 49 dynamic features, with the latter requiring only five trace flags, minimizing instrumentation cost. After feature selection, 41 features remained to train an XGBoost model to predict high-risk inputs during fuzzing. Results: Combining static and dynamic features yields over 85% precision and under 1% false alarms. Only 25% of these features are needed for comparable performance, showing that most of the search space is irrelevant. Conclusion: This work introduces feature-guided fuzzing, an automated data-driven approach that replaces coverage with data-directed inference, guiding fuzzers toward high-risk states for faster, targeted, and reproducible vulnerability discovery. To support open science, all scripts and data are available at https://github.com/KKGanguly/DataCentricFuzzJS .

📄 PDF Abstract BibTeX arXiv:2512.18102

Code (0)

등록된 구현이 없습니다.

CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation

2024-02-19 · Jueon Eom, Seyeon Jeong, Taekyoung Kwon

Fuzzing is an effective bug-finding technique but it struggles with complex systems like JavaScript engines that demand precise grammatical input. Recently, researchers have adopted language models for context-aware muta…

reinforcement-learning Reinforcement Learning Vulnerability Detection

Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzing

2025-10-14 · Myles Foley, Sergio Maffeis, Muhammad Fakhrur Rozi, Takeshi Takahashi arxiv

JavaScript engines are widely used in web browsers, PDF readers, and server-side applications. The rise in concern over their security has led to the development of several targeted fuzzing techniques. However, existing …

FuzzWiz -- Fuzzing Framework for Efficient Hardware Coverage

2024-10-23 · Deepak Narayan Gadde, Aman Kumar, Djones Lettnin, Sebastian Simon

Ever-increasing design complexity of System-on-Chips (SoCs) led to significant verification challenges. Unlike software, bugs in hardware design are vigorous and eternal i.e., once the hardware is fabricated, it cannot b…

Benchmarking

FunFuzz: An LLM-Powered Evolutionary Fuzzing Framework

2026-05-04 · Mario Rodríguez Béjar, B. Romera-Paredes, Jose L. Hernández-Ramos arxiv

Modern fuzzers increasingly use Large Language Models (LLMs) to generate structured inputs, but LLM-driven fuzzing is sensitive to prompt initialization and sampling variance, which can reduce exploration efficiency and …

Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer

2020-01-13 · Suyoung Lee, HyungSeok Han, Sang Kil Cha, Sooel Son

JavaScript (JS) engine vulnerabilities pose significant security threats affecting billions of web browsers. While fuzzing is a prevalent technique for finding such vulnerabilities, there have been few studies that lever…

Language Modeling Language Modelling valid