Fuzzilli

What it does

Build requirements

The documented workflow requires compiling a supported engine with coverage instrumentation and building Fuzzilli with Swift.checked 4 Oct 2026

Cloud deployment

The project provides Docker scripts and files for local or distributed fuzzing and scripts for setting up and tearing down distributed fuzzing on Google Compute Engine.checked 4 Oct 2026

Cloud tooling

Its Cloud directory contains Docker scripts and files, Google Compute Engine setup and teardown scripts, and rudimentary crash triaging.checked 3 Oct 2026

Contributions

Project contributions require a Contributor License Agreement and are reviewed through GitHub pull requests.checked 4 Oct 2026

Core components

The fuzzer includes a mutation fuzzer, script runner, corpus, runtime environment, minimizer, evaluator, and lifter.checked 4 Oct 2026

Deployment

The project says Fuzzilli and supported engines can be built and run inside Docker and on Google Compute Engine.checked 3 Oct 2026

Distributed fuzzing

Multiple instances can synchronize over a TCP-based protocol across machines or through dispatch queues within one process.checked 4 Oct 2026

Execution

Fuzzilli uses a read-eval-print-reset-loop mode in which a modified target engine accepts scripts over pipes or shared memory, executes them, resets, and waits for the next script.checked 3 Oct 2026

Execution mode

Fuzzilli uses a Read-Eval-Print-Reset-Loop to run repeated test cases in a target process and reduce process startup overhead.checked 4 Oct 2026

Fuzzer components

The listed components include a mutation fuzzer, script runner, corpus, environment, minimizer, evaluator, and lifter.checked 3 Oct 2026

Google support

The repository states that Fuzzilli is not an officially supported Google product.checked 4 Oct 2026

Intended users

The project describes Fuzzilli as a tool for fuzzing dynamic language interpreters and invites patches and other contributions.checked 3 Oct 2026

License

The repository identifies its license as Apache-2.0.checked 4 Oct 2026

Mutation

Its mutators change program data flow, generate or splice code, combine corpus programs, and alter operation parameters.checked 4 Oct 2026

Mutations

Its documented mutators can change data flow, generate or splice code, combine corpus programs, and modify operation parameters.checked 3 Oct 2026

Purpose

Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters that mutates programs in FuzzIL and translates them to JavaScript.checked 4 Oct 2026

Scaling

Multiple instances can synchronize within one process or over a TCP-based protocol, allowing scaling across cores and machines.checked 3 Oct 2026

Security disclosure

The project asks users to send a short note, possibly with a CVE number, or open a pull request to have a vulnerability found with Fuzzilli considered for the bug showcase.checked 3 Oct 2026

Security findings

The repository’s bug showcase lists security-impacting bugs found with Fuzzilli in JavaScript engines including WebKit, SpiderMonkey, V8, Duktape, JerryScript, and Hermes.checked 4 Oct 2026

Security results

The repository’s bug showcase lists security issues found with Fuzzilli across engines including WebKit/JavaScriptCore, SpiderMonkey, V8, Duktape, JerryScript, and Hermes.checked 3 Oct 2026

Supported targets

The target directory lists JavaScriptCore, JerryScript, QuickJS, QtJS, Serenity, SpiderMonkey, V8, XS, Duktape, and njs.checked 4 Oct 2026

Support status

The repository states that Fuzzilli is not an officially supported Google product.checked 3 Oct 2026

What it does

Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters, built around a custom intermediate language called FuzzIL that can be mutated and translated to JavaScript.checked 3 Oct 2026