Research

1. Understanding eval(): Executing JavaScript Through Strings JavaScript allows code to be generated and executed dynamically at runtime. One of the most commonly used mechanisms for this is eval(),[...]

Graphics bugs show up at every layer of Chrome's graphics stack, and attackers use them more than they used to. The standout is uninitialized memory: 91 fixes in 2026, against 6 in the nine years before.

Far more bugs are being found, in more places and of more kinds. The bugs that attackers actually use still look the way they always have.

Introduction A JavaScript fuzzer rarely builds a complex sample in one step. It may change an operator, insert a statement, replace a loop body, and then make further changes[...]

Is This Valid JavaScript? Let's analyze this JavaScript program: It looks like strange and unusual code, which raises some interesting questions: Is it valid JavaScript code? How[...]

Introduction Coverage-guided fuzzing is designed to find new execution paths. In targeted vulnerability research, however, we may already know which part of the JavaScript engine we want to explore.[...]