v147 · XML Security Fuzzer

XML Security Fuzzer

Chrome 147 rewrites the non-XSLT XML parser in Rust for memory safety without adding a new web-facing API. Test the unchanged DOMParser.parseFromString(), XMLSerializer.serializeToString(), XMLHttpRequest.responseType = "document", and fetch() plus DOMParser handoff surfaces against common XML security cases.

non-XSLT parser contract

The ChromeStatus change is an engine swap from libxml2 to a Rust XML parser for scenarios where XSLT is not required. The observable web contract is still the DOM APIs below, so the fuzzer records DOM shape and parsererror presence instead of comparing libxml-specific error strings.

DOMParserparseFromString(xml, mimeType) returns a Document for XML MIME types or a parsererror document for malformed XML.

XMLSerializerserializeToString(document) round-trips the parsed DOM so tree shape changes are visible.

XMLHttpRequestresponseType = "document" exposes the same parser through responseXML.

fetch handofffetch() returns bytes/text; this lab hands the XML text to DOMParser explicitly.

XML input 0 chars

DOMParser MIME type

Parse result

Waiting for input…

Parse time

—

Total nodes

—

Elements

—

Max depth

—

Text nodes

—

Attributes

—

MIME

—

Serialized

—

Parse result will appear here…

API surface checks

Run the current XML through the named surfaces that ChromeStatus calls out for the Rust-backed non-XSLT parser. These checks use the same text as the fuzzer, so malformed XML and entity cases stay observable.

Run a surface check to see DOMParser, XMLSerializer, XMLHttpRequest, and fetch handoff results.

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗