Repository navigation
feat: kernel engine, inject leak fixes and a measured benchmark - #3
Merged
Merged
Conversation
Kernel engine: with a fingerprint-chromium binary the fingerprint is spoofed inside Chromium from a per-profile seed and no JavaScript hooks are installed. engine=auto picks it when the binary's switch table (the framework on macOS, chrome.dll on Windows) has fingerprint-platform. The launcher only sends Emulation.setLocaleOverride, because Chrome on macOS ignores --lang. Inject engine fixes, each with a regression test against real Chrome: - Intl reported the host locale; every tab gets setLocaleOverride. - Module, shared and service workers leaked the real machine; every worker target is paused, spoofed and resumed. - Accept-Language disagreed with navigator.languages. - webdriver, plugins, connection and getBattery were own properties of navigator; they now live on Navigator.prototype. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
scripts/measure.mjs opens browserscan, creepjs, pixelscan, fingerprint.com, deviceandbrowserinfo, rebrowser and a Cloudflare challenge in a tab no automation client is attached to, masks IP addresses, and saves text and screenshots. It drives stock Chrome, both engines, AdsPower, GPM Login, Multilogin or any open browser. docs/benchmark.md holds the results; the README and llms.txt quote it instead of the earlier scores, which could not be reproduced. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The timezone was looked up for proxy.host. A gateway proxy exits from another address, often another country, so the profile could report a timezone that disagrees with the IP sites see. The lookup now goes through the relay, falling back to the host when that fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On Apple Silicon a Windows claim reads as a virtual machine to fingerprint.com: the CPU shows through. Measured on the same proxy, claiming macOS clears the virtual machine and rare device flags and drops the suspect score from 38 to 8, while browserscan stays at 100% and the Cloudflare challenge still passes (2 of 3 runs). A profile that sets fingerprint.platform is unchanged; the inject engine still defaults to Windows, so the standalone launcher no longer forces Win32 itself. When another OS is claimed on a Mac, the display is forced to sRGB, since only Mac displays report a P3 gamut and HDR. The benchmark script can now leave the platform unset (PROFILE_PLATFORM=host); docs and the changelog cover this and the exit-IP timezone fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Names the fingerprint-chromium build the benchmark ran on with its SHA-256 (matching the release digest), how to point the library at any other binary, and what kernel mode does not cover: Windows claimed on Apple Silicon, and Widevine. Fixes the outdated detection note in configuration.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
engine: 'auto' | 'kernel' | 'inject'. With a fingerprint-chromium binary the fingerprint is spoofed inside Chromium and no JavaScript hooks are installed.autodetects the binary from its switch table (framework on macOS,chrome.dllon Windows). Profiles that name no platform claim the host OS, since Windows claimed on Apple Silicon reads as a virtual machine.Intlreported the host locale; module, shared and service workers leaked the real machine; Accept-Language disagreed withnavigator.languages;webdriver,plugins,connectionandgetBatterywere own properties ofnavigator.proxy.host.scripts/measure.mjsanddocs/benchmark.md: both engines next to AdsPower, GPM Login and Multilogin on the same machine and proxy. The README's old scores could not be reproduced and are replaced.The library still ships no browser: users pick the binary with
chromePath,CHROMIUM_PATHorCHROME_PATH.Test plan
npm run typechecknpx vitest run— 203 passedBROWSER_PROFILES_E2E=1 KERNEL_PATH=… npx vitest run src/launcher/launch.e2e.test.ts src/integration— 8 passed in 4 of 5 runs; the worker e2e failed once and could not be reproduceddocs/benchmark.md🤖 Generated with Claude Code