AnalysisPublished 27 Oct 2026

Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines

Source Google Project Zero

Description

Google Project Zero compared two automated vulnerability discovery tools for Chrome's V8 JavaScript engine: Fuzzilli, a traditional fuzzer, and BigSleep, an LLM-based bug finder. Over six months, BigSleep found more vulnerabilities (45) than Fuzzilli (37), with an estimated 25-60% overlap in bugs found. Both tools find unique vulnerabilities, indicating they complement each other rather than one replacing the other. The study recommends using both fuzzing and LLM-based analysis to maximize vulnerability discovery before impacting users.

Impact

The impact is the improved discovery of vulnerabilities in a critical JavaScript engine used widely in Chrome and other environments. The complementary nature of fuzzing and LLM-based analysis means that relying on only one method could miss significant vulnerabilities. This enhances overall software security by increasing the number of vulnerabilities identified and fixed before exploitation.

Defensive guidance

No direct mitigation is required for a vulnerability here, as this is an analysis of vulnerability discovery methods rather than a specific flaw. The recommendation is for vendors to employ both fuzzing and LLM-based agentic analysis in their security testing pipelines to maximize vulnerability detection coverage.

Summary

Project Zero analyzed the effectiveness of two automated bug-finding tools targeting Chrome's V8 JavaScript engine: Fuzzilli, a generative fuzzer, and BigSleep, an LLM-based agentic bug finder. Both run in production and report bugs via Clusterfuzz. In a six-month period from April to September 2026, BigSleep found 45 actionable vulnerabilities, while Fuzzilli found 37, with an estimated overlap between 25% (bugtracker data) and 60% (dedicated experiments). The findings show that each approach discovers a substantial number of unique vulnerabilities, demonstrating that fuzzing and LLM-based analysis are complementary. The study highlights the importance of employing both methods to improve vulnerability detection in complex, well-tested software like V8.

References

projectzero.google/2026/10/fuzzing-v-AI.html (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Oct 2026, 17:27 UTC

References

Community reviews

Related threats