Michael Zalewski releases cross-document DOM binding fuzzer

Michael Zalewski (lcamtuf) yesterday announced the availability of cross_fuzz - an amazingly effective cross-document DOM binding fuzzer he claims helped him identify about 100+ bugs in all the browsers on the market - many of the bugs found are exploitable and he's still finding more. From his blog post:

The fuzzer owes much of its efficiency to dynamically generating extremely long-winding sequences of DOM operations across multiple documents, inspecting returned objects, recursing into them, and creating circular node references that stress-test garbage collection mechanisms.

This design makes it unexpectedly difficult to get clean, deterministic repros; to that effect, in the current versions of all the affected browsers, we are still seeing a collection of elusive problems when running the tool - and some not-so-elusive ones. I believe that at this point, a broader community involvement may be instrumental to tracking down and resolving these bugs.