General purpose fuzzing

As discussed, general-purpose fuzzing has been extensively explored, and we are approaching a Pareto-optimal balance between generating better inputs, enhancing feedback mechanisms, and optimizing execution speeds. With Halo, we investigated two nuanced aspects within this well-charted territory:

1. Counter-example generation: By analyzing fuzzing campaigns, we characterized the input space to bias the fuzzer toward generating more effective inputs.
2. Input space refinement: Negative examples --- inputs that neither trigger new coverage nor cause crashes --- were used to improve the description of the input space. This approach allows the fuzzer to "tighten" its input generation and focus on more promising paths.

In Tango (published at RAID'24 and recipient of the Distinguished Paper Award), we addressed a different challenge in fuzzing: statefulness. Many software systems require navigating multiple state transitions before reaching specific functionality. For instance:

• Protocol fuzzers must transition through several states to access deeper features.
• Games often demand intricate state triggers to achieve specific goals, such as "winning."

Using state inference, Tango enabled us to tackle this complexity. As a striking demonstration, we successfully used it to play challenging "pseudo" 3D games like Doom.

Securing system software

System software remains a critical target for our research. Despite its inherent challenges, its high privilege level makes it essential to secure. The primary challenges lie in its complex interfaces and the fuzzing environment itself. System software exposes a wide range of interfaces that attackers can exploit, such as virtual devices, buses, and hypercalls.

The secure monitor is the most privileged software on an ARM device, operating above the hypervisor to manage interactions between different software domains. Hypervisors, in turn, interact with diverse devices and buses to provide I/O and other services. These diverse interfaces are complex, often stateful, and challenging to model. This complexity is compounded by the lack of documentation and source code for privileged software, forming the first major research challenge.

The second challenge is the fuzzing environment itself. Unlike user-space fuzzing, where the fork() system call simplifies cloning the program under test, system software is much harder to replicate. Creating a new instance is resource-intensive, requiring tasks such as booting a kernel, instantiating a virtual machine, or resetting a phone. This results in high latency and necessitates better techniques to offset the cost, emphasizing the importance of high-quality input to maximize efficiency.

A core aspect of fuzzing is optimization given finite resources. Given limited compute cycles, the goal is to discover as many bugs as possible. While creating high-quality input is costly, it is often beneficial to include some low-quality inputs to explore diverse feedback. The more complex environments of system software demand higher-quality and more stateful inputs to balance the cost of each fuzzing iteration.

The browser, a complex target

This year, we advanced browser fuzzing with the development of a new intermediate representation that enhances our ability to target complex browser components. In GraphIR (CCS'24), we introduced this intermediate representation to provide the fuzzer with more effective mutational capabilities. By maintaining target JavaScript programs in this intermediate representation, our fuzzer applies mutation operators directly to it, enabling more sophisticated and efficient exploration.

Looking ahead, we will present DUMPLING at NDSS'25, where we leverage differential testing on the V8 JavaScript engine. This approach exposes subtle desynchronization bugs through a novel oracle, further advancing our capabilities in browser fuzzing.

In previous work, we explored specific browser components, such as fuzzing the WebGL interface (SEC'23). WebGL exposes the OpenGL interface to JavaScript, enabling 3D computations. We hypothesized that the graphics stack, being highly optimized, was (likely) under-tested. Targeting this interface posed unique challenges due to its span across multiple layers and abstractions, including the browser, libraries, the operating system kernel, and even the GPU. Achieving adequate coverage in such a complex system was difficult.

Our key innovation was replacing traditional coverage metrics with debug signals from the browser. The fuzzer generated JavaScript code that interacted with WebGL and monitored debug messages in the browser console to identify malformed code and its effects. Using these debug signals, the fuzzer iteratively mutated the code to provoke more interesting and intricate interactions with the WebGL stack.

These advancements highlight our desire to improve browser security through innovative fuzzing techniques and tailored solutions for complex components.

Introducing new Oracles

Memory safety violations are effectively detected using oracles such as AddressSanitizer, which are well-suited to low-level software and have uncovered numerous bugs in the past. However, there are many bugs that go beyond memory safety errors. In Monarch (ATC'24), we explored alternative oracles designed to detect logic bugs in distributed filesystems, such as desynchronization and other failure modes.

In parallel, we have investigated methods to prove memory accesses safe. In Uriah (CCS'24), we focused on analyzing heap accesses and demonstrated that a significant portion can be statically proven safe. This eliminates the need for instrumentation during fuzzing campaigns or even at runtime, offering stronger safety guarantees with reduced overhead. At NDSS'25, we will further explore this theme with QMSan, which uses binary rewriting to detect uninitialized reads as part of fuzzing campaigns.

In the domain of theoretical language foundations, we built upon our prior work on Enclosure (ASPLOS'21) to develop Gradient (OOPSLA'24), a language-based compartmentalization mechanism. Gradient allows developers to define fine-grained enclosures to control data accessibility. This enables natural expression of security policies when loading potentially untrusted or buggy library code, empowering developers to enforce robust compartmentalization directly within the application.

These projects represent our continued commitment to advancing memory safety, bug detection, and secure software development practices through innovative tools and foundational research.

Android security

This year, we placed a strong emphasis on Android security, building on our earlier work such as EL3XIR, where we fuzzed the secure monitor. Beyond this, we delved deeper into the security of trusted applications, uncovering critical vulnerabilities in the API used to access them.

In Spill the TeA, we conducted an empirical study examining how trusted applications are patched and whether they are protected against rollback attacks. While these applications are signed, they often lack robust rollback protection. Specifically, if rollback counters are not incremented, older (and potentially vulnerable) versions of applications can still be loaded and exploited. Alarmingly, we found that rollback counters are rarely utilized, leaving Android users exposed to attacks from outdated applications across different devices and models.

Our study also highlighted a fundamental flaw in the GlobalPlatform API, which governs the interaction between Android applications and trusted applications. This API requires developers to verify whether each argument in a call is a scalar or a pointer. Unfortunately, this crucial step is frequently overlooked, leading to arbitrary write vulnerabilities in trusted applications. This issue was widespread, and our findings, detailed in GlobalConfusion, prompted vendors to update the GlobalPlatform API standard to address this recurring vulnerability.

Additionally, we investigated the security of Android's hardened scudo memory allocator, which is designed to make heap allocations less predictable using probabilistic keys. However, we discovered that Android's "Zygote" fork model compromises several of Scudo's mitigations, making exploitation easier. In our Scudo paper, presented at WOOT'24 and awarded Best Paper, we explored various attack patterns that exploit these weakened protections.

In summary, Android's complexity and the interactions between its many components create a unique security landscape, exposing vulnerabilities in trusted application access, inter-application communication, and library usage. Over the coming years, we plan to continue exploring the Android ecosystem, as it presents numerous opportunities for impactful security research.

Conclusion and Outlook

This year, we made significant strides in security research across fuzzing, system software, browser security, and Android security. Our work in fuzzing, including Halo and Tango, tackled stateful systems and advanced input generation. On privileged systems, tools like EL3XIR and HyperPill revealed critical bugs in secure monitors and hypervisors.

In browser security, GraphIR enhanced fuzzing capabilities, while alternative oracles such as Monarch uncovered logic bugs. In Android security, we identified rollback vulnerabilities and critical API flaws, while demonstrating exploitation risks in memory allocators.

Looking ahead, we aim to deepen our focus on stateful fuzzing, evolving security frameworks, and exploring new attack surfaces. While fuzzing research is gradually slowing down, we continue to explore niche areas and develop specialized oracles to address underexplored challenges. In the medium term, fuzzing is expected to transition from a research focus to an engineering discipline, with research efforts shifting to other domains. Promising areas of exploration include alternative oracles that go beyond memory safety, advancements in compartmentalization, and the complex and dynamic field of Android security.

We are excited about the opportunities that lie ahead and look forward to another productive year of research. None of this would be possible without the dedication and creativity of our exceptional team of postdocs, PhD students, researchers, and collaborators whose passion and vision drive our efforts to push the boundaries of security.