一句话：提出生产上下文敏感文法 PCSG，从 W3C 标准构建并增强文法，以提升浏览器模糊测试的语义覆盖与正确性。
浏览器蕴含丰富语义，支撑多样 Web 功能，但也给实现与测试带来挑战。传统模糊测试依赖手写上下文无关文法（CFG）生成输入，难以充分建模浏览器复杂语义，导致覆盖有限且输入易出现语义错误。本文提出 SaGe，一种基于生产上下文敏感文法（PCSG）的自动化浏览器模糊测试方法。它先从 W3C 标准中提取基础 CFG，再迭代增强语义信息，形成 PCSG，使模糊器生成更多语义正确且能探索更广浏览器语义的输入。作者在 Chrome、Safari 和 Firefox 上进行 24 小时模糊测试，与现有浏览器模糊器相比，边覆盖提升 6.03%–277.80%，语义正确率提升 3.56%–161.71%，发现缺陷数翻倍；共识别 62 个缺陷，40 个确认，10 个获 CVE。
Web browsers exhibit rich semantics that enable a plethora of web-based functionalities. However, these intricate semantics present significant challenges for the implementation and testing of browsers. For example, fuzzing, a widely adopted testing technique, typically relies on handwritten context-free grammars (CFGs) for automatically generating inputs. However, these CFGs fall short in adequately modeling the complex semantics of browsers, resulting in generated inputs that cover only a portion of the semantics and are prone to semantic errors. In this paper, we present SaGe, an automated method that enhances browser fuzzing through the use of production-context sensitive grammars (PCSGs) incorporating semantic information. Our approach begins by extracting a rudimentary CFG from W3C standards and iteratively enhancing it to create a PCSG. The resulting PCSG enables our fuzzer to generate inputs that explore a broader range of browser semantics with a higher proportion of semantically-correct inputs. To evaluate the efficacy of SaGe, we conducted 24-hour fuzzing campaigns on mainstream browsers, including Chrome, Safari, and Firefox. Our approach demonstrated better performance compared to existing browser fuzzers, with a 6.03%-277.80% improvement in edge coverage, a 3.56%-161.71% boost in semantic correctness rate, twice the number of bugs discovered. Moreover, we identified 62 bugs across the three browsers, with 40 confirmed and 10 assigned CVEs.
@article{paperbot1895,
title = {Towards Better Semantics Exploration for Browser Fuzzing},
author = {Chijin Zhou and Quan Zhang and Lihua Guo and Mingzhe Wang and Yu Jiang and Qing Liao and Zhiyong Wu and Shanshan Li and Bin Gu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {OOPSLA2},
year = {2023},
doi = {10.1145/3622819}
}