Abstract:With the popularity of computers and mobile devices and the development of the Internet, browsers (applications used to retrieve and display information resources on the World Wide Web) are often included by default and have become an indispensable software. Therefore, research on browser security issues is essential for protecting information assets. Among many browsers in the industry, Chrome, as a cross-platform web browser developed by Google, occupies a large market share in desktop browsers, and its security risks are further amplified as its kernel is used by many other browsers. Therefore, the research on the security issues of Chrome browser is critical for browser security. This paper focuses on the vulnerability detection of the process communication interface in Chrome browser, and designs and implements a fuzzing framework, auto-mojo-fuzz (AMF). The fuzzing process mainly designs a sample optimization technique to ensure the effectiveness of input samples and improve the efficiency of fuzzing. After implementing the AMF solution, we evaluate the generated test samples to demonstrate the effectiveness of the sample optimization technique. We also prove the possibility of discovering more vulnerabilities with AMF, and tests it with the latest version of Chrome browser, finding five unique crashes, four of which are verified as security vulnerabilities, effectively proving the automatic and efficient ability of this framework to discover vulnerabilities in the process communication interfaces in browsers.

Based on the FUZZING Lead to a New Mining Method Based on Windows Kernel Vulnerability

Research on the Exploitability of Binary Software Vulnerabilities

AMF: Efficient Browser Interprocess Communication Fuzzing

Survey of OS Kernel Fuzzing

The research on the fuzzing

Proactive Vulnerability Finding Via Information Flow Tracking

Research for Buffer Overflow Vulnerabilities Based on Multi-Dimensional Fuzzing Technology

File Format Vulnerability Exploiting Technique Based on Fuzzing

New method of software vulnerability detection based on fuzzing

A Novel Method of Software Vulnerability Detection based on Fuzzing Technique

Based on the Cause of the New Vulnerabilities Patch Attack Method Research

A Survey of Automatic Exploitation of Binary Vulnerabilities

SHFuzz: A Hybrid Fuzzing Method Assisted by Static Analysis for Binary Programs

Effective Fuzzing Based on Dynamic Taint Analysis

Design and Realization of Ie Vulnerabilities Mining Based on Fuzz Testing

Principle and Attack Method of Kernel Overflow under Win32 Enviroment

Network computer security hidden dangers and vulnerability mining technology

StateFuzz: System Call-Based State-Aware Linux Driver Fuzzing

Software security vulnerability exploitation method based on a security patch

An Improved Design for Smart Fuzzing Platform

KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations