Coverage-guided fuzzing is designed to find new execution paths. In targeted vulnerability research, however, we may already know which part of the JavaScript engine we want to explore.

A previous vulnerability, a suspicious commit, or a source-code review may point to a specific V8 function. The challenge is then to keep generating new JavaScript programs without allowing mutations to move execution away from that code.

With Code Targeting, we select the engine code relevant to the research goal. SeekZero then filters and prioritizes campaign samples or keeps Mutation Plan variants on the selected code.

In our previous post, we used the proof of concept for CVE-2026-11645 to build a SeekZero Mutation Plan. The vulnerability was caused by an inconsistent transition of an object’s Map while V8 was adding a data property to a class that extends Function.

A shortened version of the upstream regression test shows the core structure:

The first instance initializes the property with a small integer. Before the second instance is created, the value changes to a double. This causes V8 to reconfigure the property representation while adding the class field.

In v8, creating the class field reaches JSObject::CreateDataProperty. For a named property, JSObject::CreateDataProperty first calls TryFastAddDataProperty:

TryFastAddDataProperty then prepares a new Map for the value:

If the Map becomes a dictionary map, the fast path stops and execution falls back to the standard property-addition path. This gives us two clear Code Targeting targets: JSObject::CreateDataProperty and TryFastAddDataProperty.

The Mutation Plan can preserve the class inheritance, computed field, strict function body, and value transition. This keeps the important parts of the original sample in place, but it does not ensure that every generated variant will follow the same engine path.

The Playground coverage view shows that the original sample reaches these functions before mutation begins.

Reaching these functions does not mean the vulnerability was triggered. It only means the sample still runs the code we want to target.

A mutation can create a valid sample that no longer reaches the selected V8 code. In this example, a mutation could:

• Remove the inheritance from Function
• Replace or remove the computed class field
• Stop creating the second class instance
• Change the values so that the property representation is not reconfigured
• Throw an exception before the relevant property-addition path is reached

Some of these variants may still discover new coverage elsewhere in V8. From a general fuzzing perspective, they may remain useful. But for this research goal, they no longer exercise the selected path.

A sample may still run correctly while no longer reaching the selected V8 code. Lock and Preserve can keep important parts of the JavaScript in place, but they cannot ensure that V8 follows the same path. Changes to values or execution order can still lead V8 elsewhere.

Code Targeting can be used in two ways. It can be configured directly on a campaign, without a Mutation Plan, so the selected functions apply to the campaign as a whole. It can also be added to a Mutation Plan, where the targets apply to mutations created from a specific sample.

Code Targeting is not limited to functions. We can target an entire source file when exploring a broader area, or specific source lines when looking at a particular change or bugfix.

Campaign-level Code Targeting is useful when we know which engine code we want to explore but do not yet have a sample for a Mutation Plan. If a source review points to TryFastAddDataProperty, we can add it as a campaign target. SeekZero then filters and prioritizes samples based on whether they reach that function.

Samples that miss the target are filtered out, while samples that reach it are given higher priority.

When a promising sample reaches the function, we can create a Mutation Plan from it and use the same target to keep later mutations on that path. Campaign-level targeting helps us find a useful starting point, while Mutation Plan targeting helps us explore around it.

The example in this post uses the second approach. We add JSObject::CreateDataProperty and TryFastAddDataProperty to the Mutation Plan so that mutations created from the sample continue to reach them.

With these targets in the Mutation Plan, SeekZero applies a mutation and executes the resulting JavaScript program. It then checks the generated coverage:

1. If the sample still reaches the selected functions, the mutation remains valid.
2. If one of the required functions is no longer reached, the mutation is invalid and SeekZero reverts it.
3. SeekZero continues mutation without keeping the off-target change.

The sample can change, but it must continue reaching the selected code.

Code Targeting works alongside Lock and Preserve:

• Lock prevents mutations from being applied to a selected syntax-tree node.
• Preserve prevents replacement or deletion from removing a structure.
• Code Targeting verifies that the resulting program still reaches the selected engine code at runtime.

Together, these controls keep the required JavaScript structure in place and ensure that the sample still reaches the selected path.

In the following demo, we start with the CVE-2026-11645 regression sample in the Playground and confirm that it reaches the target functions. We then turn the sample into a Mutation Plan and target lines inside those functions.

The preview generates variants around the original sample. Each accepted step changes the JavaScript while continuing to reach the selected code.

In this example, we selected two functions involved in CVE-2026-11645. SeekZero then ensured that generated samples continued to reach them while the JavaScript changed. At campaign level, Code Targeting filters and prioritizes samples that reach the selected functions. In a Mutation Plan, it keeps mutations from a specific sample on those functions. In both cases, it reduces time spent on unrelated samples.

• CVE-2026-11645: SeekZero Mutation Plans
• Fuzzing Complex JavaScript Structures
• V8 fix: Abort TryFastAddDataProperty if the map becomes slow
• SeekZero