Security Experts:

Connect with us

Hi, what are you looking for?



Google Open Sources Fuzzing Platform

Google announced this week that it has open sourced ClusterFuzz, the fuzzing infrastructure it built to help finding memory corruption bugs in Chrome.

Google announced this week that it has open sourced ClusterFuzz, the fuzzing infrastructure it built to help finding memory corruption bugs in Chrome.

The platform runs on over 25,000 cores and for two years has been available as a free service to open source projects through the OSS-Fuzz service. 

An automated method for detecting bugs in software, fuzzing is effective only if continuous, done at scale, and integrated into the development process of a software project, and ClusterFuzz has been created specifically for that, Google says.  

Created more than 8 years ago, ClusterFuzz provides end-to-end automation, including bug detection, deduplication, bisection, reporting, and closure of bug reports.

To date, the platform has found over 16,000 vulnerabilities in Chrome and more than 11,000 vulnerabilities across more than 160 open source projects integrated with OSS-Fuzz. With ClusterFuzz, bugs can be detected within hours after being introduced and the fix verified within a day, Google says. 

Now available on GitHub, ClusterFuzz is highly scalable, provides accurate deduplication of crashes, testcase minimization, regression finding through bisection, and statistics for analyzing fuzzer performance and crash rates. 

It also has an easy-to-use web interface for management and viewing crashes, and provides support for coverage guided fuzzing (e.g. libFuzzer and AFL) and blackbox fuzzing.

ClusterFuzz can be deployed locally on a compute cluster, although production use is reliant on some key Google Cloud Platform services. 

Related: Google Wants More Projects Integrated With OSS-Fuzz

Related: Researchers Introduce Smart Greybox Fuzzing

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.