JavaScript engine fuzzing improved by smart state-aware instrumentation
State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation
Cryptography and Security
Summary
JavaScript engines that run web code are very complex and sometimes have hidden problems that can cause security bugs. The researchers found that traditional testing methods get stuck because they can't tell apart different internal states of the engine that look the same on the surface. They created a new way called StateLens that uses large language models to find important internal engine details automatically, adding sensors that help tests explore deeper hidden bugs. Their approach helps the testing tools find more serious errors by understanding what’s really happening inside the engine.
What this means in practice
- •For web browser developers: Improve testing of JavaScript engines by focusing on hidden internal states to find deep bugs missed by traditional fuzzers.
- •For security testing teams: Enhance fuzzing tools with smart guidance to detect complex engine vulnerabilities that affect web security.
Authors
Wai Kin Wong, Dongwei Xiao, Anthony Cheuk Tung Lai, Ping Fan Ke, Shuai Wang
Abstract
The security of the modern web depends on the correctness of JavaScript (JS) engines, yet these complex systems remain vulnerable to high-impact bugs. A critical limitation of state-of-the-art fuzzers is the coverage plateau: once a fuzzer saturates the control-flow graph, edge coverage loses its ability to guide discovery. Because complex engine behaviors, such as JIT optimization tiers and hidden class transitions, often share identical edge coverage, standard coverage metrics are blind to the distinct internal states required to trigger deep errors. To bridge this gap, we present StateLens, a framework that employs Large Language Models (LLM) to automate the discovery of deep internal states. Blindly placing instrumentation probes at all states is infeasible due to the vast state space and the high runtime overhead. StateLens introduces a novel agent-based reasoning pipeline that emulates the intuition of a security researcher. By iteratively traversing code and developer comments, our agents intelligently select high-value instrumentation targets, effectively separating logic-driving state variables from irrelevant data. This results in synthesizable, high-signal feedback probes that map the engine's hidden configurations. This instrumentation feeds a dual-feedback mechanism, effectively guiding the fuzzer toward unexplored engine semantics. Our evaluation confirms that StateLens significantly outperforms state-of-the-art fuzzers and uncovering 68 new bugs.