TL;DR
DarthShader introduces a novel fuzzing approach targeting WebGPU shader translators and compilers, revealing numerous security vulnerabilities across popular browsers by effectively testing complex multi-stage compilation pipelines.
Contribution
It is the first language fuzzer combining intermediate representation and AST mutators to test the entire WebGPU shader compilation pipeline, improving fault detection over existing methods.
Findings
Discovered 39 software faults in Chrome, Firefox, Safari
15 CVEs assigned to vulnerabilities found by DarthShader
Outperformed state-of-the-art fuzzers in code coverage
Abstract
A recent trend towards running more demanding web applications, such as video games or client-side LLMs, in the browser has led to the adoption of the WebGPU standard that provides a cross-platform API exposing the GPU to websites. This opens up a new attack surface: Untrusted web content is passed through to the GPU stack, which traditionally has been optimized for performance instead of security. Worsening the problem, most of WebGPU cannot be run in the tightly sandboxed process that manages other web content, which eases the attacker's path to compromising the client machine. Contrasting its importance, WebGPU shader processing has received surprisingly little attention from the automated testing community. Part of the reason is that shader translators expect highly structured and statically typed input, which renders typical fuzzing mutations ineffective. Complicating testing…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
