Chrome's user interface code is complex and sometimes has bugs, which can be security bugs if they result in memory corruption that an attacker can exploit. The Chrome team wants to find these bugs automatically, and they realized that the accessibility tree of Chrome UI controls, which is exposed to assistive technology, can be used for this purpose. They are using a technique called fuzzing, which involves interacting with the UI controls semi-randomly to see if they can make things crash. The team had to overcome several challenges, including leveraging coverage-guided fuzzing to select combinations of controls that reach into new code within Chrome, and running fuzz cases within a real version of Chrome using the InProcessFuzzer framework. They also had to address concerns about the noise and complexity of the Chrome environment, and ensure that the test cases are stable and actionable. The team developed a custom mutator to improve the effectiveness of the fuzzer, and they are now running the fuzzer on their ClusterFuzz infrastructure. Although it's too early to tell if the approach is successful, the fuzzer has already found a couple of potential bugs in the accessibility code itself.