State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation

2026-09-21

AI Summary

为解决JavaScript引擎中的高影响漏洞问题，提出StateLens框架，利用大型语言模型智能选择高价值的插桩目标，指导模糊测试探索未被发现的引擎语义。

Abstract

The security of the modern web depends on the correctness of JavaScript (JS) engines, yet these complex systems remain vulnerable to high-impact bugs. A critical limitation of state-of-the-art fuzzers is the coverage plateau: once a fuzzer saturates the control-flow graph, edge coverage loses its ability to guide discovery. Because complex engine behaviors, such as JIT optimization tiers and hidden class transitions, often share identical edge coverage, standard coverage metrics are blind to the distinct internal states required to trigger deep errors. To bridge this gap, we present StateLens, a framework that employs Large Language Models (LLM) to automate the discovery of deep internal states. Blindly placing instrumentation probes at all states is infeasible due to the vast state space and the high runtime overhead. StateLens introduces a novel agent-based reasoning pipeline that emulates the intuition of a security researcher. By iteratively traversing code and developer comments, our agents intelligently select high-value instrumentation targets, effectively separating logic-driving state variables from irrelevant data. This results in synthesizable, high-signal feedback probes that map the engine's hidden configurations. This instrumentation feeds a dual-feedback mechanism, effectively guiding the fuzzer toward unexplored engine semantics. Our evaluation confirms that StateLens significantly outperforms state-of-the-art fuzzers and uncovering 68 new bugs.

Problem

• JavaScript engines
• coverage plateau
• internal states
• fuzzers
• vulnerabilities

Innovation

• Large Language Models
• agent-based reasoning
• high-value instrumentation targets
• dual-feedback mechanism
• deep internal states