Fuzzilli vs BigSleep: 37 and 45 Vulnerabilities Found in V8 Over Six Months with 25% Overlap
Google's Project Zero team conducted a detailed comparison of two automated tools used to hunt vulnerabilities in V8, the JavaScript and WebAssembly engine powering Chrome. The study pitted the generative JavaScript fuzzer Fuzzilli against BigSleep, an agentic system powered by large language models. Over a six-month period from April to September 2026, BigSleep discovered more vulnerabilities than Fuzzilli (45 versus 37), yet only roughly 25% of the bugs overlapped. Experiments on older bugs suggested the true intersection could reach approximately 60%.
Production Statistics
Both systems operate in production and report crashes through Clusterfuzz, which performs initial triage and creates bug reports in the Chromium tracker. Fuzzilli runs continuously across many instances and typically picks up new code changes within hours. BigSleep runs once per day, reviewing recent commits and generating proof-of-concept test cases for discovered issues.
Raw reports showed Fuzzilli producing 316 bugs and BigSleep producing 441. After filtering for vulnerabilities only and then for actionable reports (those not marked duplicate or WAI and linked to at least one fixing commit), the numbers became 37 for Fuzzilli and 45 for BigSleep. This represents a near tie with a slight edge for the LLM-based agent.
Overlap Analysis
Researchers measured overlap in two ways. First, they examined the bug tracker for reports filed by one system that were marked duplicates of reports from the other, including indirect duplicates resolved through Clusterfuzz signatures and fixing commits. For actionable vulnerabilities, the overlap reached approximately 25% (20 out of 81), with slightly more than half first discovered by Fuzzilli.
In a second experiment, BigSleep was tasked with rediscovering 112 historical Fuzzilli bugs from 2023 to mid-2026. The agent successfully reproduced the original bug in 62% of cases and found a different (already fixed) bug in another 12%. No statistically significant memorization effect was observed when comparing success rates across different time periods relative to the model's knowledge cutoff.
Bug Complexity and Components
Analysis of rediscovery rates by bug complexity (measured by time taken for Fuzzilli to find the issue) showed that harder-to-find bugs for the fuzzer were also harder for the LLM agent. Overlap was notably lower for bugs in compiler components, where Fuzzilli has specialized strengths.
The study concludes that both techniques remain valuable. A substantial portion of vulnerabilities was found exclusively by one method or the other. The rapid progress of LLM agents is encouraging, yet fuzzing and agentic analysis currently complement each other. The authors recommend that software projects apply both fuzzing and LLM-based analysis to reduce the number of vulnerabilities reaching end users.
Related articles
ISPsystem Publishes Detailed Timeline of VMmanager 6 Attack and Vulnerability Analysis
ISPsystem has released a comprehensive post detailing a recent security incident targeting its VMmanager 6 virtualization management platform. The company outlines the chronology of the attack, the specific vulnerabilities exploited by threat actors, and the current mitigation status. The incident has sparked significant discussion within the professional hosting and virtualization community. ISPsystem emphasizes transparency and provides technical breakdowns to help users understand the attack vectors and required defensive measures. The post covers how the attackers gained initial access and the subsequent impact on managed virtual environments.
Google Fixes 52 Vulnerabilities in Chrome Including Four Critical Issues
Google has released security updates for its Chrome browser that address a total of 52 vulnerabilities. Four of these flaws received the highest severity rating of Critical. The updates were issued on October 27, 2026, for Windows, macOS, and Linux platforms. The critical vulnerabilities include memory corruption in the file system, input validation issues in the file API, problems in the Skia graphics library, and a Use After Free flaw in the Layout component. Specific CVEs patched are CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, and CVE-2026-118344. The remaining 48 vulnerabilities received lower severity ratings but were still addressed in the same release.
CISA Adds Brotli and Adobe Commerce Flaws to Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. CVE-2026-111497 affects Google’s Brotli data compression library and can lead to code execution, information disclosure, or denial of service when specially crafted compressed data is processed. The flaw impacts any software that incorporates the Brotli decoder for decompression tasks, prompting vendors to release updates. CVE-2026-48356 resides in the file upload functionality of Adobe Commerce and Magento, allowing attackers to exploit improper handling during upload operations. CISA issued the alert on October 27, 2026, urging organizations to apply patches immediately to mitigate ongoing attacks. Related advisories also reference Brotli fixes in PHP and other products that bundle the library.
October 'In Trend VM' Report: Exploited Windows ALPC and Check Point VPN Vulnerabilities
Positive Technologies has released its October edition of the 'In Trend VM' digest, highlighting two actively exploited vulnerabilities. The first is CVE-2026-85880, a local privilege escalation flaw in the Windows ALPC mechanism that was used as a zero-day in targeted attacks by multiple APT clusters. The second is CVE-2026-85102, a critical remote code execution vulnerability in Check Point Security Gateway and Spark Firewall products that affects VPN negotiation. Both issues have been added to CISA's KEV catalog, with public proof-of-concept code already available for the Check Point flaw. The report details attack chains, affected versions, and recommended patches or workarounds.