Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
Google's internal benchmark pitting its LLM-driven BigSleep against the Fuzzilli fuzzer on V8 suggests AI-guided approaches are catching more engine bugs—raising the bar for defenders relying on fuzzing alone.
Summary written by editorial AI · Source link below
Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug finding system. In the past six months, BigSleep found more vulnerabilities than Fuzzilli (45 versus 37) with a 25% overlap in the specific bugs reported. Since this comparison methodology has a tendency to underestimate overlap, we also performed dedicated experiments to
Editorial Analysis
As LLM-guided vulnerability discovery matures, enterprises should anticipate a faster pace of zero-day disclosure in foundational browser components and plan patching cycles accordingly.
Review your organisation's browser-patching SLA and ensure rapid deployment capability for V8/Chromium fixes as AI-driven discovery accelerates disclosure timelines.
AI tools are now finding more browser-engine vulnerabilities than traditional fuzzers, compressing the window between discovery and exploitation.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Project Zero in a new tab.
More from the Research Desk
- Firecracker VM Escape: PwnEscape Part 23d
- A Gingerbread House for LLM Agents: Source-Planned Honeypots That Lure Autonomous Attackers into an Isolated Shadow3d
- LABBA: LLM-Assisted Behavioral Biometric Authentication3d
- A Cyber Range Evaluation of Inductive Autonomous Network Incident Response Agents3d
- KeHoSu: Keyed Homoglyph Substitution for Authenticated Text Provenance over Copy-Paste Channels3d