Clone this repo:


  1. de91bb0 Bound recursive calls of token_to_string to prevent *san errors. by Jonathan Metzman · 3 days ago master
  2. 8359b00 Misc improvements / javascript parser proto fuzzer. by Marja Hölttä · 3 days ago
  3. a4a7612 Adding a templated-dictionary based V8 parser fuzzer. by Marja Hölttä · 4 days ago
  4. b062f5b [libFuzzer] Use full path to libfuzzer_exports.h in fuzzer_test.gni. by Max Moroz · 4 days ago
  5. 27a9057 Coverage script: add "--filter" option for specifying sources to be shown in the report. by Max Moroz · 4 days ago

libFuzzer in Chrome


This directory contains integration between libFuzzer and Chrome. libFuzzer is an in-process coverage-driven evolutionary fuzzer. It helps engineers to uncover potential security & stability problems earlier.

Requirements: libFuzzer in Chrome is supported with GN on Mac and Linux only.

Integration Status

Fuzzer tests are well-integrated with Chrome build system & distributed ClusterFuzz fuzzing system. Cover bug:


  • Getting Started Guide walks you through all the steps necessary to create your fuzzer and submit it to ClusterFuzz.
  • Efficient Fuzzer Guide explains how to measure fuzzer effectiveness and ways to improve it.
  • Guide to libprotobuf-mutator walks through the steps necessary to create a fuzzer that libFuzzer gives mutated protobufs to as input (for developers already familiar with libFuzzer).
  • ClusterFuzz Integration describes integration between ClusterFuzz and libFuzzer.
  • Reproducing contains information on how to reproduce bugs reported by ClusterFuzz.
  • Reference contains detailed references for different integration parts.


  • ClusterFuzz Bugs - issues found and automatically filed by ClusterFuzz.
  • Manual Bugs - issues that were filed manually after running fuzzers.
  • Pdfium Bugs - bugs found in pdfium by manual fuzzing.
  • OSS Trophies - bugs found with libFuzzer in open-source projects.

Blog Posts

Project Links