Boosted by @joe@f.duriansoftware.com
The fuzzer that found https://project-zero.issues.chromium.org/issues?q=componentid:1638259%20%22V8%20Sandbox%20Bypass%22 (and a number of issues prior to that as well) is now open-source: https://crrev.com/c/7580844
It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h for details). Definitely had fun writing it!