Abstract:A recent trend towards running more demanding web applications, such as video games or client-side LLMs, in the browser has led to the adoption of the WebGPU standard that provides a cross-platform API exposing the GPU to websites. This opens up a new attack surface: Untrusted web content is passed through to the GPU stack, which traditionally has been optimized for performance instead of security. Worsening the problem, most of WebGPU cannot be run in the tightly sandboxed process that manages other web content, which eases the attacker's path to compromising the client machine. Contrasting its importance, WebGPU shader processing has received surprisingly little attention from the automated testing community. Part of the reason is that shader translators expect highly structured and statically typed input, which renders typical fuzzing mutations ineffective. Complicating testing further, shader translation consists of a complex multi-step compilation pipeline, each stage presenting unique requirements and challenges. In this paper, we propose DarthShader, the first language fuzzer that combines mutators based on an intermediate representation with those using a more traditional abstract syntax tree. The key idea is that the individual stages of the shader compilation pipeline are susceptible to different classes of faults, requiring entirely different mutation strategies for thorough testing. By fuzzing the full pipeline, we ensure that we maintain a realistic attacker model. In an empirical evaluation, we show that our method outperforms the state-of-the-art fuzzers regarding code coverage. Furthermore, an extensive ablation study validates our key design. DarthShader found a total of 39 software faults in all modern browsers -- Chrome, Firefox, and Safari -- that prior work missed. For 15 of them, the Chrome team assigned a CVE, acknowledging the impact of our results.

ESFuzzer: An Efficient Way to Fuzz WebAssembly Interpreter

Fuzzm: Finding Memory Bugs through Binary-Only Instrumentation and Fuzzing of WebAssembly

AMF: Efficient Browser Interprocess Communication Fuzzing

MorFuzz: Fuzzing Processor Via Runtime Instruction Morphing Enhanced Synchronizable Co-simulation.

ES-FUZZ: Improving the Coverage of Firmware Fuzzing with Stateful and Adaptable MMIO Models

FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities

A Lightweight and High-Precision Approach for Bulky JavaScript Engines Fuzzing

EM-Fuzz: Augmented Firmware Fuzzing Via Memory Checking

Towards Better Semantics Exploration for Browser Fuzzing

EVMFuzzer - detect EVM vulnerabilities via fuzz testing.

Semantic Sensitive Coverage-based Fuzzing

DarthShader: Fuzzing WebGPU Shader Translators & Compilers

Wapplique: Testing WebAssembly Runtime Via Execution Context-aware Bytecode Mutation

EF/CF: High Performance Smart Contract Fuzzing for Exploit Generation

EnFuzz: from Ensemble Learning to Ensemble Fuzzing.

EnclaveFuzz: Finding Vulnerabilities in SGX Applications

JIT-Picking: Differential Fuzzing of JavaScript Engines

EnFuzz: Ensemble Fuzzing with Seed Synchronization among Diverse Fuzzers

Tacoma: Enhanced Browser Fuzzing with Fine-Grained Semantic Alignment

A Fuzzer for Detecting Use-After-Free Vulnerabilities

Target Program Select Test Input Trim Test Input Mutate Test Input Execute Program Update Queue Instrument Program Grammar