CheckOps home

Tools directory

F

CheckOps

Fuzzilli

Fuzzilli is Google Project Zero's Apache-2.0 coverage-guided fuzzer for JavaScript engines, mutating a custom intermediate language, FuzzIL, that is lifted to JavaScript.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language, FuzzIL, which can be mutated and translated to JavaScript.

Targets include patched builds of major JavaScript engines listed in its Targets directory; you compile the engine with coverage instrumentation and run swift run FuzzilliCli --profile=<engine> /path/to/jsshell. Distributed fuzzing spreads work across machines. Tagged releases are old (2023), but the repository has commits as recent as November 2026.

In the quality loop Fuzzilli targets JIT and interpreter bugs.

The source code is at googleprojectzero/fuzzilli on GitHub under the Apache-2.0 licence, with about 2,400 stars; the most recent commit was on 11 November 2026.

Features

  1. FuzzIL: Semantic-aware mutations.
  2. Coverage guidance: Instrumented engines.
  3. Engine profiles: Several JS engines.
  4. Distributed mode: Scale across machines.
  5. Corpus import: Seed from JS samples.
  6. Swift implementation: Built with Swift.

Pros

  1. Specialised: Designed for JS engines.
  2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
  3. Actively maintained: The repository had commits as recent as 11 November 2026.

Cons

  1. Narrow scope: Only for interpreter developers.
  2. Patching required: Engines need patches.
  3. Old tagged releases: Use the main branch.
swift run -c release FuzzilliCli --profile=v8 /path/to/d8

Resources:

Pricing

Fuzzilli is free and open source under the Apache-2.0 licence.

  1. JavaScript engine and runtime teams.

Conclusion

Fuzzilli is the leading open fuzzer for JavaScript engines.

Use main-branch builds.

On CheckOps, Fuzzilli is filed under the Security testing stage. Related tools listed here include libFuzzer, AFL++, honggfuzz, LibAFL, OSS-Fuzz and ClusterFuzzLite. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Fuzzilli side by side.