Category: Browser Engine / Web Platform
1. Description
Each browser engine (Blink/Chrome, Gecko/Firefox, WebKit/Safari) implements a different subset of Web APIs and CSS features. Additionally, each has unique rendering quirks, default settings, and behavior patterns. These are inherent to the browser no proxy can change them because they are compiled into the browser binary.
2. Vectors
2.1 Web API Feature Support
The browser exposes ~100+ feature tests that fingerprinting scripts enumerate:
High-value features for identification:
| API | Chrome | Firefox | Safari | Notes |
|---|---|---|---|---|
| WebGL 2 | All modern | |||
| WebGPU | (flag) | Chrome-only | ||
| WebUSB | Chrome-only | |||
| Web Bluetooth | Chrome-only | |||
| Web NFC | Android | Chrome-only | ||
| Web Serial | Chrome-only | |||
| Web Share | Varies by platform | |||
| Battery API | Only Firefox | |||
| Speech Synthesis | Varies by voice | |||
| GamePad API | Partial | Safari limited | ||
| MathML | Firefox/Safari only | |||
| Web Workers | All, but Shared Workers vary | |||
| Service Workers | All modern | |||
| CSS Container Queries | Safari late to adopt | |||
| CSS Subgrid | Safari late to adopt |
Entropy: ~10-15 bits (but highly correlated reduces to browser family + version)
2.2 CSS Feature Support
Hundreds of CSS properties and values vary by browser:
/* Test via @supports */
@supports (backdrop-filter: blur(1px)) { /* Chrome + Safari */ }
@supports (-webkit-backdrop-filter: blur(1px)) { /* Safari legacy */ }
@supports (accent-color: red) { /* Chrome 93+, Firefox 92+, Safari 15.4+ */ }
@supports (container-type: inline-size) { /* Chrome 105+, Firefox 110+, Safari 16+ */ }
Entropy: ~8-12 bits (identifies browser engine + major version)
2.3 Browser Implementation Quirks
Each browser has unique rendering behavior:
| Quirk | Example | Browser |
|---|---|---|
| Scrollbar width | 12px vs 15px vs 0px (overlay) | OS-dependent* |
| Form element styling | Button padding, border radius | Engine-specific |
| Unicode rendering | Emoji support version | OS+browser dependent |
<details> behavior |
Open/close animation | Engine-specific |
Date() parsing |
Non-standard date formats | Engine-specific |
JSON.stringify() order |
Property enumeration order | Engine-specific (fixed in ES6) |
performance.now() resolution |
5s vs 100s vs 1ms | Chrome vs Firefox vs Safari |
*Scrollbar width reveals OS: Windows=12-17px, macOS=variable (thin/overlay), Linux=varies
2.4 Font Rendering Metrics
Even with the same fonts installed, different OS/browser combinations render text differently:
const span = document.createElement('span')
span.textContent = 'mmmmmmmmmmlli'
document.body.appendChild(span)
const width = span.getBoundingClientRect().width
// Width varies by OS font rendering engine (FreeType, CoreText, DirectWrite)
Entropy: ~4-6 bits
2.5 Default Browser Configuration
Browsers ship with different defaults:
| Setting | Chrome | Firefox | Safari |
|---|---|---|---|
| Default font | Times New Roman | Times New Roman | Times |
| Default font size | 16px | 16px | 16px |
| Minimum font size | 0px | 0px | 12px (varies) |
| Default language | OS locale | OS locale | OS locale |
| Image auto-loading | On | On | On |
| JavaScript | On | On | On |
| Cookies | Allowed | Allowed | Allowed (blocked in private) |
2.6 Chrome-Specific: User-Agent Reduction
Chrome progressively reduces User-Agent information. The new navigator.userAgentData API provides structured data:
- Brands list (e.g.,
"Google Chrome";v="120") - Platform (e.g.,
"Windows","macOS") - Mobile flag
- Architecture, bitness, model, platformVersion (can be withheld)
Notable: Safari does not implement userAgentData, and Firefox only recently started. This is itself a signal.
3. Attacker's Strengths
| Strength | Explanation |
|---|---|
| Cannot be changed | Browser features are compiled into the browser |
| No permission required | Feature tests are silently executed |
| Rapid enumeration | 100+ features tested in <10ms |
| Stable across versions | Features rarely change within a browser version |
| Binary (yes/no) vector | Can be easily combined into a unique hash |
4. Attacker's Weaknesses
| Weakness | Explanation | Exploitable? |
|---|---|---|
| Low individual entropy | Basic browser identification; not individual user | No |
| DNS-blockable | Feature detection scripts must load from server | Yes |
| Correlated | All Chrome 120 users look the same | No |
| Changes with updates | Browser updates change feature sets | Occasional |
| Privacy mode affects | Private/incognito modifies some features | Partial |
5. Detection of Tampering
| Technique | How It Works |
|---|---|
| Feature inconsistency | Claiming Chrome features but returning Firefox feature set |
| Missing expected features | Chrome without WebUSB is suspicious |
| Timing anomalies | Feature enumeration taking too long? |
| Too-clean feature vector | Real browsers have some rare features missing |
6. Mitigations for Obscura
6.1 What Obscura Can Do
| Mitigation | Effectiveness | Detectability | Implementation |
|---|---|---|---|
| DNS block fingerprinting domains | High (prevents enumeration) | Low | Blocklist management |
| Inject feature override JS | Low (too many features) | High | Override individual APIs |
| Accept browser features are low entropy | Passive | None | Document residual risk |
6.2 What Obscura Cannot Do
| Cannot | Why |
|---|---|
| Add features the browser doesn't have | Cannot make Firefox support WebUSB |
| Remove features the browser has | Cannot disable features from proxy (user can via flags) |
| Change CSS rendering | Rendering is in the browser engine |
| Change font metrics | Font rendering is in the OS/browser |
6.3 Recommended Approach
1. DNS blocking of fingerprinting domains (prevents feature enumeration best defense)
2. Profile consistency (at least make claimed browser match actual features)
3. Accept residual risk (feature vector mainly identifies browser version, not user)
7. Research References
- Eckersley, P. (2010). "How Unique Is Your Web Browser?" PETS 2010.
- Mulazzani, M. et al. (2013). "Fast and Reliable Browser Fingerprinting." ACSAC 2013.
- Laperdrix, P. et al. (2020). "Browser Fingerprinting: A Survey." ACM TOIT.
- Modernizr (2026). "Feature detection library." github.com/modernizr/modernizr.
- BrowserLeaks (2026). "Features Detection." browserleaks.com/features.