- Home
- Fuzz Testing Software
- Fuzzilli
Fuzzilli
What it is
Fuzzilli is a free, open-source fuzzer for testing dynamic language interpreters. It represents programs in FuzzIL, a custom intermediate language, then mutates them and translates them to JavaScript for execution. Its mutators can change data flow or operation parameters, generate or splice code, and combine programs from a corpus. The components include a mutation fuzzer, script runner, corpus, runtime environment, minimizer, evaluator and lifter. Fuzzilli runs repeated test cases through a target process that executes a script, resets and waits for another. Multiple instances can coordinate within one process or across machines using a TCP-based protocol. Listed targets include JavaScriptCore, JerryScript, QuickJS, QtJS, Serenity, SpiderMonkey, V8, XS, Duktape and njs. Setup requires compiling a supported JavaScript engine with coverage instrumentation using clang 4.0 or later, then building Fuzzilli with Swift Package Manager. Docker and Google Compute Engine tools are provided. It supports Linux, macOS and self-hosted use under the Apache-2.0 license, and the project states it is not an officially supported Google product.
For and against
For
- Coverage guidance directs testing toward program paths.
- Mutators generate, splice and combine test programs.
- Instances can coordinate across machines over TCP.
- Docker and Google Compute Engine tooling is provided.
- Licensed under Apache-2.0.
Against
- Requires building a supported, instrumented JavaScript engine.
- Build requires clang 4.0 or later and Swift Package Manager.
- Not an officially supported Google product.
The verdict
Fuzzilli provides a configurable approach to fuzzing supported dynamic language interpreters, with tools for test generation, execution and minimization. Its setup requires building both the fuzzer and an instrumented target engine.
Who it suits
Fuzzilli is for developers and security practitioners working on dynamic language interpreters and JavaScript engines. It may suit teams able to build an instrumented target and the fuzzer themselves.
Plans and prices
Fuzzilli
Apache-2.0 licensed source code · requires building the fuzzer and a supported, instrumented JavaScript engine
Read 4 Oct 2026 · github.com
On the record
- Build requirements
- The documented workflow requires compiling a supported engine with coverage instrumentation and building Fuzzilli with Swift.github.com · read 4 Oct 2026
- Cloud deployment
- The project provides Docker scripts and files for local or distributed fuzzing and scripts for setting up and tearing down distributed fuzzing on Google Compute Engine.github.com · read 4 Oct 2026
- Cloud tooling
- Its Cloud directory contains Docker scripts and files, Google Compute Engine setup and teardown scripts, and rudimentary crash triaging.github.com · read 3 Oct 2026
- Contributions
- Project contributions require a Contributor License Agreement and are reviewed through GitHub pull requests.github.com · read 4 Oct 2026
- Core components
- The fuzzer includes a mutation fuzzer, script runner, corpus, runtime environment, minimizer, evaluator, and lifter.github.com · read 4 Oct 2026
- Deployment
- The project says Fuzzilli and supported engines can be built and run inside Docker and on Google Compute Engine.github.com · read 3 Oct 2026
- Distributed fuzzing
- Multiple instances can synchronize over a TCP-based protocol across machines or through dispatch queues within one process.github.com · read 4 Oct 2026
- Execution
- Fuzzilli uses a read-eval-print-reset-loop mode in which a modified target engine accepts scripts over pipes or shared memory, executes them, resets, and waits for the next script.github.com · read 3 Oct 2026
- Execution mode
- Fuzzilli uses a Read-Eval-Print-Reset-Loop to run repeated test cases in a target process and reduce process startup overhead.github.com · read 4 Oct 2026
- Fuzzer components
- The listed components include a mutation fuzzer, script runner, corpus, environment, minimizer, evaluator, and lifter.github.com · read 3 Oct 2026
- Google support
- The repository states that Fuzzilli is not an officially supported Google product.github.com · read 4 Oct 2026
- Intended users
- The project describes Fuzzilli as a tool for fuzzing dynamic language interpreters and invites patches and other contributions.github.com · read 3 Oct 2026
- License
- The repository identifies its license as Apache-2.0.github.com · read 4 Oct 2026
- Mutation
- Its mutators change program data flow, generate or splice code, combine corpus programs, and alter operation parameters.github.com · read 4 Oct 2026
- Mutations
- Its documented mutators can change data flow, generate or splice code, combine corpus programs, and modify operation parameters.github.com · read 3 Oct 2026
- Purpose
- Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters that mutates programs in FuzzIL and translates them to JavaScript.github.com · read 4 Oct 2026
- Scaling
- Multiple instances can synchronize within one process or over a TCP-based protocol, allowing scaling across cores and machines.github.com · read 3 Oct 2026
- Security disclosure
- The project asks users to send a short note, possibly with a CVE number, or open a pull request to have a vulnerability found with Fuzzilli considered for the bug showcase.github.com · read 3 Oct 2026
