Saltar al contenido principal
en/blog/obscura/research/uncontrollable/browser-features-quirks/

obscura/research/uncontrollable/browser-features-quirks

6 min read

Category: Browser Engine / Web Platform


1. Description

Each browser engine (Blink/Chrome, Gecko/Firefox, WebKit/Safari) implements a different subset of Web APIs and CSS features. Additionally, each has unique rendering quirks, default settings, and behavior patterns. These are inherent to the browser no proxy can change them because they are compiled into the browser binary.


2. Vectors

2.1 Web API Feature Support

The browser exposes ~100+ feature tests that fingerprinting scripts enumerate:

High-value features for identification:

API Chrome Firefox Safari Notes
WebGL 2 All modern
WebGPU (flag) Chrome-only
WebUSB Chrome-only
Web Bluetooth Chrome-only
Web NFC Android Chrome-only
Web Serial Chrome-only
Web Share Varies by platform
Battery API Only Firefox
Speech Synthesis Varies by voice
GamePad API Partial Safari limited
MathML Firefox/Safari only
Web Workers All, but Shared Workers vary
Service Workers All modern
CSS Container Queries Safari late to adopt
CSS Subgrid Safari late to adopt

Entropy: ~10-15 bits (but highly correlated reduces to browser family + version)

2.2 CSS Feature Support

Hundreds of CSS properties and values vary by browser:

/* Test via @supports */
@supports (backdrop-filter: blur(1px)) { /* Chrome + Safari */ }
@supports (-webkit-backdrop-filter: blur(1px)) { /* Safari legacy */ }
@supports (accent-color: red) { /* Chrome 93+, Firefox 92+, Safari 15.4+ */ }
@supports (container-type: inline-size) { /* Chrome 105+, Firefox 110+, Safari 16+ */ }

Entropy: ~8-12 bits (identifies browser engine + major version)

2.3 Browser Implementation Quirks

Each browser has unique rendering behavior:

Quirk Example Browser
Scrollbar width 12px vs 15px vs 0px (overlay) OS-dependent*
Form element styling Button padding, border radius Engine-specific
Unicode rendering Emoji support version OS+browser dependent
<details> behavior Open/close animation Engine-specific
Date() parsing Non-standard date formats Engine-specific
JSON.stringify() order Property enumeration order Engine-specific (fixed in ES6)
performance.now() resolution 5s vs 100s vs 1ms Chrome vs Firefox vs Safari

*Scrollbar width reveals OS: Windows=12-17px, macOS=variable (thin/overlay), Linux=varies

2.4 Font Rendering Metrics

Even with the same fonts installed, different OS/browser combinations render text differently:

const span = document.createElement('span')
span.textContent = 'mmmmmmmmmmlli'
document.body.appendChild(span)
const width = span.getBoundingClientRect().width
// Width varies by OS font rendering engine (FreeType, CoreText, DirectWrite)

Entropy: ~4-6 bits

2.5 Default Browser Configuration

Browsers ship with different defaults:

Setting Chrome Firefox Safari
Default font Times New Roman Times New Roman Times
Default font size 16px 16px 16px
Minimum font size 0px 0px 12px (varies)
Default language OS locale OS locale OS locale
Image auto-loading On On On
JavaScript On On On
Cookies Allowed Allowed Allowed (blocked in private)

2.6 Chrome-Specific: User-Agent Reduction

Chrome progressively reduces User-Agent information. The new navigator.userAgentData API provides structured data:

  • Brands list (e.g., "Google Chrome";v="120")
  • Platform (e.g., "Windows", "macOS")
  • Mobile flag
  • Architecture, bitness, model, platformVersion (can be withheld)

Notable: Safari does not implement userAgentData, and Firefox only recently started. This is itself a signal.


3. Attacker's Strengths

Strength Explanation
Cannot be changed Browser features are compiled into the browser
No permission required Feature tests are silently executed
Rapid enumeration 100+ features tested in <10ms
Stable across versions Features rarely change within a browser version
Binary (yes/no) vector Can be easily combined into a unique hash

4. Attacker's Weaknesses

Weakness Explanation Exploitable?
Low individual entropy Basic browser identification; not individual user No
DNS-blockable Feature detection scripts must load from server Yes
Correlated All Chrome 120 users look the same No
Changes with updates Browser updates change feature sets Occasional
Privacy mode affects Private/incognito modifies some features Partial

5. Detection of Tampering

Technique How It Works
Feature inconsistency Claiming Chrome features but returning Firefox feature set
Missing expected features Chrome without WebUSB is suspicious
Timing anomalies Feature enumeration taking too long?
Too-clean feature vector Real browsers have some rare features missing

6. Mitigations for Obscura

6.1 What Obscura Can Do

Mitigation Effectiveness Detectability Implementation
DNS block fingerprinting domains High (prevents enumeration) Low Blocklist management
Inject feature override JS Low (too many features) High Override individual APIs
Accept browser features are low entropy Passive None Document residual risk

6.2 What Obscura Cannot Do

Cannot Why
Add features the browser doesn't have Cannot make Firefox support WebUSB
Remove features the browser has Cannot disable features from proxy (user can via flags)
Change CSS rendering Rendering is in the browser engine
Change font metrics Font rendering is in the OS/browser

6.3 Recommended Approach

1. DNS blocking of fingerprinting domains  (prevents feature enumeration  best defense)
2. Profile consistency                        (at least make claimed browser match actual features)
3. Accept residual risk                       (feature vector mainly identifies browser version, not user)

7. Research References

  • Eckersley, P. (2010). "How Unique Is Your Web Browser?" PETS 2010.
  • Mulazzani, M. et al. (2013). "Fast and Reliable Browser Fingerprinting." ACSAC 2013.
  • Laperdrix, P. et al. (2020). "Browser Fingerprinting: A Survey." ACM TOIT.
  • Modernizr (2026). "Feature detection library." github.com/modernizr/modernizr.
  • BrowserLeaks (2026). "Features Detection." browserleaks.com/features.