Event-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
summary
Claims a reproducible pipeline that finds 40+ Chrome and Android bugs by combining patch-analysis, event-driven fuzzing, and pattern scans. Builds a targeted fuzzer and writes CodeQL/Weggli rules to scan branches and vendor forks, automates user actions with Puppeteer and X2 to trigger UI/timing races, and demonstrates multiple CVEs (eg. 2020-6466, 2020-6554) plus dozens of downstream vendor issues. Shows which patch details to re-exercise, which checks omit, and which scans yield high true-positive rates.
AI-written summary · about
chapters (9)
- 0:00Bug hunting strategies
- 1:50Vulnerability discovery journey
- 5:33Fuzzing with user actions
- 9:14Simulating user interactions
- 12:50Patch-based research examples
- 16:47Android ecosystem vulnerabilities
- 21:45Static analysis of vulnerabilities
- 24:56Comment police insights
- 27:54Conclusion and key takeaways
related talks
53mThree Colours of Fuzzing: Reflections and Open Challenges
15mSqueezing Juicy Variant Bugs Out of Modern Browsers
52mStructure aware fuzzing
01mFrom Bugs to Breaches
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing
53mFuzz Testing for Fun and Profit
37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser
43mSyzbot and the Tale of Thousand Kernel Bugs