Skip to content
SPECIFICTION
Get listed

Fuzzilli

github.com

Free plan macOSLinuxSelf-hosted
Visit github.com
Spec score 8.4 #6 of 26 in Fuzz Testing Software

What it is

Fuzzilli is a free, open-source, coverage-guided fuzzer for dynamic language interpreters. It represents test programs in FuzzIL, mutates them, and translates them to JavaScript for execution. Its mutators can change data flow or operation parameters, generate or splice code, and combine corpus programs. Components include a mutation fuzzer, script runner, corpus, environment, minimizer, evaluator, and lifter. A target engine runs repeated scripts in a read-eval-print-reset loop, resetting between cases; multiple instances can synchronize within a process or across machines over TCP. Listed target directories include JavaScriptCore, JerryScript, QuickJS, QtJS, Serenity, SpiderMonkey, V8, XS, Duktape, and njs. Setup requires compiling a supported engine with coverage instrumentation using clang 4.0 or later, then building Fuzzilli with Swift Package Manager. Docker and Google Compute Engine tooling are provided. The project supports Linux, macOS, and self-hosted use and identifies its license as Apache-2.0. Its repository says it is not an officially supported Google product. Contributions require a Contributor License Agreement and are reviewed through GitHub pull requests.

Spec sheet

What it does
Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters, built around a custom intermediate language called FuzzIL that can be mutated and translated to JavaScript.Read 3 Oct 2026 · github.com
Purpose
Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters that mutates programs in FuzzIL and translates them to JavaScript.Read 4 Oct 2026 · github.com
Intended users
The project describes Fuzzilli as a tool for fuzzing dynamic language interpreters and invites patches and other contributions.Read 3 Oct 2026 · github.com
Deployment
The project says Fuzzilli and supported engines can be built and run inside Docker and on Google Compute Engine.Read 3 Oct 2026 · github.com
License
The repository identifies its license as Apache-2.0.Read 4 Oct 2026 · github.com
Build requirements
The documented workflow requires compiling a supported engine with coverage instrumentation and building Fuzzilli with Swift.Read 4 Oct 2026 · github.com
Cloud deployment
The project provides Docker scripts and files for local or distributed fuzzing and scripts for setting up and tearing down distributed fuzzing on Google Compute Engine.Read 4 Oct 2026 · github.com
Cloud tooling
Its Cloud directory contains Docker scripts and files, Google Compute Engine setup and teardown scripts, and rudimentary crash triaging.Read 3 Oct 2026 · github.com
Contributions
Project contributions require a Contributor License Agreement and are reviewed through GitHub pull requests.Read 4 Oct 2026 · github.com
Core components
The fuzzer includes a mutation fuzzer, script runner, corpus, runtime environment, minimizer, evaluator, and lifter.Read 4 Oct 2026 · github.com
Distributed fuzzing
Multiple instances can synchronize over a TCP-based protocol across machines or through dispatch queues within one process.Read 4 Oct 2026 · github.com
Execution
Fuzzilli uses a read-eval-print-reset-loop mode in which a modified target engine accepts scripts over pipes or shared memory, executes them, resets, and waits for the next script.Read 3 Oct 2026 · github.com
Execution mode
Fuzzilli uses a Read-Eval-Print-Reset-Loop to run repeated test cases in a target process and reduce process startup overhead.Read 4 Oct 2026 · github.com
Fuzzer components
The listed components include a mutation fuzzer, script runner, corpus, environment, minimizer, evaluator, and lifter.Read 3 Oct 2026 · github.com
Google support
The repository states that Fuzzilli is not an officially supported Google product.Read 4 Oct 2026 · github.com
Mutation
Its mutators change program data flow, generate or splice code, combine corpus programs, and alter operation parameters.Read 4 Oct 2026 · github.com
Mutations
Its documented mutators can change data flow, generate or splice code, combine corpus programs, and modify operation parameters.Read 3 Oct 2026 · github.com
Scaling
Multiple instances can synchronize within one process or over a TCP-based protocol, allowing scaling across cores and machines.Read 3 Oct 2026 · github.com
Security disclosure
The project asks users to send a short note, possibly with a CVE number, or open a pull request to have a vulnerability found with Fuzzilli considered for the bug showcase.Read 3 Oct 2026 · github.com
Security findings
The repository’s bug showcase lists security-impacting bugs found with Fuzzilli in JavaScript engines including WebKit, SpiderMonkey, V8, Duktape, JerryScript, and Hermes.Read 4 Oct 2026 · github.com
Security results
The repository’s bug showcase lists security issues found with Fuzzilli across engines including WebKit/JavaScriptCore, SpiderMonkey, V8, Duktape, JerryScript, and Hermes.Read 3 Oct 2026 · github.com
Support status
The repository states that Fuzzilli is not an officially supported Google product.Read 3 Oct 2026 · github.com
Supported targets
The target directory lists JavaScriptCore, JerryScript, QuickJS, QtJS, Serenity, SpiderMonkey, V8, XS, Duktape, and njs.Read 4 Oct 2026 · github.com

Plans and prices

Fuzzilli Free Apache-2.0 licensed source code · requires building the fuzzer and a supported, instrumented JavaScript engine Read 4 Oct 2026 · github.com

Every Fuzzilli plan and price →

Strong points and limits

Strong points

  • Coverage-guided testing with mutation, generation, and hybrid methods
  • Can synchronize instances within a process or across machines
  • Docker and Google Compute Engine tooling provided
  • Apache-2.0 licensed source code
  • Repository lists multiple JavaScript engine targets

Limits

  • Requires a supported engine built with coverage instrumentation
  • Build requires clang 4.0 or later and Swift Package Manager
  • Not an officially supported Google product
  • Contributions require a Contributor License Agreement

Who it suits

Fuzzilli suits developers and security researchers fuzzing JavaScript engines or other dynamic language interpreters. It requires building both the fuzzer and a supported, coverage-instrumented engine.

Verdict

Fuzzilli provides a configurable fuzzing workflow with multiple engine targets and options for scaling across machines. Setup involves building an instrumented target engine as well as the fuzzer, and the project is not officially supported by Google.

Where Specifiction places it

Alternatives to FuzzilliAll alternatives →