On the Effectiveness of Mutational Grammar Fuzzing

This analysis discusses the limitations of mutational grammar fuzzing, a technique that uses predefined grammars to mutate inputs while maintaining structural validity. The author highlights that increased code coverage does not necessarily correlate with finding more bugs, especially in complex language fuzzing scenarios where triggering bugs requires specific sequences of function calls. The analysis points out that coverage-guided fuzzers may struggle to combine multiple samples effectively to trigger such bugs, and that generative fuzzers might sometimes be more effective. The discussion is based on practical experience and examples from fuzzing XSLT implementations and JIT engines.

• projectzero.google/2026/03/mutational-grammar-fuzzing.html (opens in a new tab)