ClusterFuzz
No phone app
in Fuzz Testing Software
- Recognised40% of the score20
- Phone app26% of the score0
- Documented20% of the score98
- Free plan14% of the score100
- Free plan
- Yes
- Runs on
- Linux, Mac, self-hosted, Web, Windows
Summary
ClusterFuzz is open-source infrastructure that uses fuzzing to find security and stability issues in software. It supports coverage-guided fuzzing with libFuzzer, AFL++, and Honggfuzz, as well as blackbox fuzzing. Its workflow can find crashes, group duplicate reports, minimize testcases, bisect revisions to locate regressions, and verify fixes. It can also automate bug filing, triage, and closure. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz; the project says it can run on clusters of any size. Production deployments depend on Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver. Local instances can use Google Cloud emulators, but features depending on BigQuery and Stackdriver are disabled, and local instances are supported only on Linux and macOS. ClusterFuzz runs on Linux, macOS, and Windows. Its repository is licensed under Apache-2.0, and the architecture currently supports Chromium-hosted Monorail as its bug tracker.
Who it is for
ClusterFuzz suits software teams that need automated fuzzing and crash triage across Linux, macOS, or Windows. Local deployment is an option for Linux and macOS users; production deployment depends on Google Cloud services.
What is good
- Supports libFuzzer, AFL++, and Honggfuzz.
- Minimizes testcases and bisects regressions.
- Can automate bug filing and triage.
- Apache-2.0 licensed and free.
What to know first
- Production deployments depend on Google Cloud services.
- Local instances are supported only on Linux and macOS.
- Local BigQuery- and Stackdriver-dependent features are disabled.
- Architecture currently supports Chromium-hosted Monorail as its bug tracker.
Verdict
ClusterFuzz combines fuzzing with crash processing and bug-tracker automation, and it is available under an open-source license. Deployment requirements differ between production and local use, and local users should note the operating-system and feature limitations.
ClusterFuzz plans and pricing
All plansCompared on fuzz testing software
- Input generation methods
- mutation, generation, hybridgoogle.github.io
- Target types
- binary formats, HTML, JavaScript, browser DOM, native programsgoogle.github.io
- Coverage guidance
- Yesgoogle.github.io
- Crash triage
- Yesgoogle.github.io
- Execution mode
- hybridgoogle.github.io
- Supported languages
- C, C++, Rust; potentially other LLVM-based languagesgoogle.github.io
- CI/CD support
- Yesgoogle.github.io
Facts
- Purpose
- ClusterFuzz is scalable fuzzing infrastructure that finds security and stability issues in software.google.github.io · 2 Oct 2026
- Google and OSS-Fuzz
- Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz.google.github.io · 2 Oct 2026
- Scalability
- ClusterFuzz can run on any size cluster; Google’s instance runs on 30,000 VMs.google.github.io · 2 Oct 2026
- Fuzzing engines
- It supports libFuzzer, AFL++, and Honggfuzz for coverage-guided fuzzing, plus blackbox fuzzing.github.com · 2 Oct 2026
- Crash processing
- Features include crash deduplication, testcase minimization, and regression finding through bisection.github.com · 2 Oct 2026
- Bug automation
- ClusterFuzz can automatically file, triage, and close bugs for issue trackers such as Monorail and Jira.github.com · 2 Oct 2026
- End-to-end workflow
- The infrastructure finds and triages crashes, minimizes reproducers, bisects revisions, and verifies fixes.google.github.io · 2 Oct 2026
- Supported operating systems
- ClusterFuzz runs on Linux, macOS, and Windows.google.github.io · 2 Oct 2026
- Cloud dependencies
- Production deployments use Google Cloud services including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring.google.github.io · 2 Oct 2026
- Local deployment
- ClusterFuzz can run locally with Google Cloud emulators, but BigQuery- and Stackdriver-dependent features are disabled and local instances are supported only on Linux and macOS.google.github.io · 2 Oct 2026
- Bug tracker limit
- The only bug tracker currently supported by the architecture is Chromium-hosted Monorail.google.github.io · 2 Oct 2026
- Web interface
- The web interface includes Testcases, Fuzzer Statistics, Crash Statistics, Upload Testcase, Jobs, and Configuration pages.google.github.io · 2 Oct 2026
- Access control
- Privileged users can access security bugs, upload fuzzers and corpora, and create jobs, while administrators also manage configuration and permissions.google.github.io · 2 Oct 2026
- Authentication
- ClusterFuzz supports various authentication providers using Firebase.github.com · 2 Oct 2026
- Security reporting
- The Google Security Team asks vulnerability reporters to use g.co/vulnz and says reports are processed within a day with responses within a week depending on severity.github.com · 2 Oct 2026
- Support
- Users can file a GitHub issue to ask questions, request features, or ask for help.github.com · 2 Oct 2026
- License
- The ClusterFuzz repository is published under the Apache-2.0 license.github.com · 2 Oct 2026
- Crash handling
- It provides crash deduplication, automatic bug filing and triage, testcase minimization, and regression finding through bisection.google.github.io · 2 Oct 2026
- Integrations
- The overview lists Monorail and Jira as example issue trackers and Firebase for authentication; the architecture page says Monorail is currently the only supported bug tracker.google.github.io · 2 Oct 2026
- Cloud requirements
- Production deployments run on Google Cloud Platform and depend on services including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring.google.github.io · 2 Oct 2026
- Other compute
- Fuzzing bots can run on machines outside Google Compute Engine, including machines from another cloud provider, if they can access the required Google services.google.github.io · 2 Oct 2026
- Local limitations
- Local instances can run without Google Cloud emulators, but some features that depend on BigQuery and Stackdriver are disabled.google.github.io · 2 Oct 2026
- Supported systems
- ClusterFuzz runs on Linux, macOS, and Windows, while local instances are supported only on Linux and macOS.google.github.io · 2 Oct 2026
- Security issues found
- The project repository reports that, as of February 2023, ClusterFuzz helped identify and fix over 8,900 vulnerabilities across projects integrated with OSS-Fuzz.github.com · 2 Oct 2026
Best ClusterFuzz alternatives
See all 12Where it ranks on Samsung Mobile US Press
Is ClusterFuzz yours?
Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.
Sources
- google.github.io/clusterfuzz/· checked 2 Oct 2026
- github.com/google/clusterfuzz· checked 2 Oct 2026
- google.github.io/clusterfuzz/architecture/· checked 2 Oct 2026
- google.github.io/clusterfuzz/using-clusterfuzz/ui-overvi· checked 2 Oct 2026
- google.github.io/clusterfuzz/using-clusterfuzz/advanced/· checked 2 Oct 2026
- github.com/google/clusterfuzz/security· checked 2 Oct 2026
- google.github.io/clusterfuzz/production-setup/clusterfuz· checked 2 Oct 2026