Skip to content
NewA calmer, faster ZeroHour
Researchlow

State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation

arXiv cs.CRby Wai Kin Wong ()1 min read3 · 2 reads
Read at arxiv.org
AI summary · grok-4.7Summaries by Vani AI

StateLens uses LLM-guided instrumentation to fuzz JavaScript engines and found 68 bugs.

StateLens is a fuzzing framework that uses large language models to instrument hidden internal states in JavaScript engines, where ordinary edge coverage plateaus. Agent-style reasoning walks code and developer comments to place high-signal probes, then a dual-feedback loop steers fuzzing toward unexplored semantics such as JIT tiers and hidden-class transitions. The authors report that StateLens beats prior fuzzers and uncovered 68 new bugs. No CVE identifiers or in-the-wild exploitation are stated.

Key facts
  • StateLens targets hidden JS-engine states missed by edge coverage.
  • LLM agents pick instrumentation from code and developer comments.
  • Dual feedback guides fuzzing toward unexplored engine semantics.
  • The evaluation reports 68 new bugs over prior fuzzers.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
fuzzingjavascriptllmstatelensjitvulnerability-discoveryinstrumentation
Products
StateLens

From the original article

1 min read at arxiv.org

The security of the modern web depends on the correctness of JavaScript (JS) engines, yet these complex systems remain vulnerable to high-impact bugs. A critical limitation of state-of-the-art fuzzers is the coverage plateau: once a fuzzer saturates the control-flow graph, edge coverage loses its ability to guide discovery.

arXiv cs.CR

By Wai Kin Wong · arxiv.org

Read the full article at arXiv cs.CR

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.