Publication Type
Conference Proceeding Article
Version
publishedVersion
Publication Date
10-2026
Abstract
The security of the modern web depends on the correctness of JavaScript (JS) engines, yet these complex systems remain vulnerable to high-impact bugs. A critical limitation of state-of-the-art fuzzers is the coverage plateau: once a fuzzer saturates the control-flow graph, edge coverage loses its ability to guide discovery. Because complex engine behaviors, such as JIT optimization tiers and hidden class transitions, often share identical edge coverage, standard coverage metrics are blind to the distinct internal states required to trigger deep errors. To bridge this gap, we present StateLens, a framework that employs Large Language Models (LLM) to automate the discovery of deep internal states. Blindly placing instrumentation probes at all states is infeasible due to the vast state space and the high runtime overhead. State-Lens introduces a novel agent-based reasoning pipeline that emulates the intuition of a security researcher. By iteratively traversing code and developer comments, our agents intelligently select high-value instrumentation targets, effectively separating logic-driving states from irrelevant data. This results in synthesizable, high-signal feedback probes that map the engine's hidden configurations. This instrumentation feeds a dual-feedback mechanism, effectively guiding the fuzzer toward unexplored engine semantics. Our evaluation confirms that StateLens significantly outperforms state-of-the-art fuzzers and uncovers 68 new bugs.
Keywords
JavaScript engine fuzzing, fuzz testing, state coverage, large language models, program analysis, programinstrumentation, vulnerability discovery
Discipline
Information Security | Software Engineering
Research Areas
Information Systems and Management
Areas of Excellence
Digital transformation
Publication
SOSP '26: Proceedings of the ACM SIGOPS 32nd Symposium on Operating Systems Principles, Prague, Czech Republic, September 29 - October 2
First Page
988
Last Page
1003
Identifier
10.1145/3830418.3843900
Publisher
ACM
City or Country
New York
Citation
WONG, Wai Kin; XIAO, Dongwei; LAI, Cheuk Tung; KE, Ping Fan; and WANG, Shuai.
State-aware fuzzing of JavaScript engines with LLM-guided instrumentation. (2026). SOSP '26: Proceedings of the ACM SIGOPS 32nd Symposium on Operating Systems Principles, Prague, Czech Republic, September 29 - October 2. 988-1003.
Available at: https://ink.library.smu.edu.sg/sis_research/11365
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Additional URL
https://doi.org/10.1145/3830418.3843900