Announcing the Fuzzilli Research Grant Program
Summary: Google Project Zero announced a USD $50,000 pilot program awarding up to USD $5,000 in Google Compute Engine credits per accepted proposal for research into JavaScript engine fuzzing, running from Oct 1, 2020 to Oct 1, 2021. Applicants must fuzz JavaScriptCore, v8, or Spidermonkey, report all bugs only to the affected vendor, publish new source code under an open source license, and file a final report within 6 months of the first grant.
Why it matters: Project Zero cites in-the-wild 0day exploits abusing v8 and notes that the GCE instances used to find roughly 20 bugs with Fuzzilli in 2019 cost around USD $10,000 - a cost researchers must bear before any bounty is paid, which the program says likely leaves bugs unfixed and exploitable for longer.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026