Using Chrome's accessibility APIs to find security bugs

Google Chrome’s security team describes a new approach to fuzzing the browser’s UI by interacting with the accessibility tree, combining coverage-guided fuzzing, InProcessFuzzer, and Centipede to explore complex UI paths and produce stable, reproducible test cases. The post details challenges like stateful UI interactions, noisy coverage, and control identification, and introduces a custom mutator to improve effectiveness. Early runs have only found a few potential issues in accessibility code, with broader UI coverage and results still pending.