The Fuzzer Reached the Code, yet Missed the State: LLM-Guided JavaScript Engine Fuzzing

[ Abstract ]

Fuzzers reach the vulnerable code and still miss the bug because coverage tracks lines, not state. StateLens has an LLM identify security-relevant internal states offline and lets a conventional fuzzer do the search: 68 previously unknown bugs across six production JavaScript engines.

Structural coverage is the dominant metric for evaluating fuzzers, yet many bugs in JavaScript (JS) engines are triggered by specific internal states that are not captured by line or branch coverage. As LLMs have demonstrated strong reasoning capabilities, an increasing trend is to use them for auditing code or generating fuzzing inputs. However, directly using LLMs for JS engines is not practical due to huge code bases, high False Positive (FP) rates, and high cost.

We propose StateLens, a novel approach that combines the strengths of LLMs and fuzzing through the unique lens of state coverage. Instead of asking an LLM to directly generate fuzzing inputs or predict vulnerabilities by auditing, StateLens uses it offline to identify security-relevant internal states and synthesize feedback probes; a conventional fuzzer then performs the online search at high throughput.

Across six production JavaScript engines, StateLens uncovered 68 previously unknown bugs, at least 35 with confirmed security implications. Some of our bugs have been publicly acknowledged or rewarded by Google, Meta, and Apple. Compared with state-of-the-art (SOTA) JS engine fuzzers, StateLens finds more bugs in the same time frame.