The fuzzer that found https://project-zero.issues.chromium.org/issues?q=componentid:1638259%20%22V8%20Sandbox%20Bypass%22 (and a number of issues prior to that as well) is now open-source: https://crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!