TL;DR: browser fingerprint spoofing
- Browser fingerprinting identifies a device from its canvas hash, WebGL parameters, font stack, user agent, screen geometry, and audio context. Spoofing tools alter or randomize these values so one device looks like many.
- Spoofing is commodity software: playwright-stealth, Puppeteer-stealth, Canvas Fingerprint Defender, and a dozen packaged stealth modules are freely available and actively maintained.
- Attribute spoofing defeats attribute-only detectors. Behavioral signals, TLS characteristics, and cross-session device identity are much harder to spoof simultaneously, and that is where modern fraud detection wins.
- cside collects 250+ signals from real visitor browsers. Spoofing canvas and WebGL is not enough when behavioral cadence and cross-session device signals remain consistent.
Which fingerprint signals spoofing tools target
A browser fingerprint combines properties that the browser exposes to JavaScript into a stable identifier. The most informative signals include:
- Canvas hash: draw an off-screen string and hash the pixel output. Different GPUs and font renderers produce subtly different results, even for the same nominal browser version.
- WebGL parameters: the renderer string, vendor, and supported extensions vary between graphics cards and driver versions.
- Font stack: CSS or JavaScript font enumeration reveals which system fonts are installed, a combination that differs between operating systems and user setups.
- Audio context fingerprint: an off-screen audio graph produces a floating-point output whose low-order bits differ by platform and OS audio stack.
- Hardware concurrency and device memory: the number of CPU cores and reported memory size, coarse values the browser exposes via the Navigator API.
- User agent, screen resolution, color depth, and pixel ratio: lower-entropy signals, frequently used in combination.
- TLS handshake hash: network-layer signal derived from the cipher suite order and extensions in the ClientHello; not browser JavaScript, but part of the broader fingerprint stack.
The combination of these signals is nearly unique per device per browser instance. That uniqueness is what fraud systems rely on to link sessions, flag device reuse across accounts, and spot bots that recycle the same hardware.
Why spoofing is now commodity software
The gap between building a detection-evading bot and buying a stealth script has closed completely. The tools are public, maintained, and well-documented:
Playwright-stealth and Puppeteer-stealth patch the properties that headless browsers expose by default: navigator.webdriver (set to true in Puppeteer and older Playwright), an empty navigator.plugins array, a flat navigator.languages array, and missing media codecs. A patched build looks like a real browser on the surface. By the end of 2025, cside research found playwright-stealth roughly ten times more widely deployed than a year earlier.
Canvas and WebGL spoofing extensions such as Canvas Fingerprint Defender (Chrome Web Store) randomize the pixel output of canvas draw calls per origin or per session. From a detection system's perspective, the device produces a different canvas hash on every request, which breaks identifier continuity.
FingerprintSwitcher and similar tools let a user set a fixed synthetic fingerprint profile (user agent, screen resolution, canvas hash, WebGL renderer) and hold it constant across sessions, impersonating a different device entirely.
Custom Chromium builds used by organized fraud operations modify the rendering engine directly. These are harder to detect because they do not rely on JavaScript patches that can themselves be detected.
What spoofing cannot easily fake
Attribute spoofing patches the reported values, but several signals are harder or impossible to alter convincingly:
Behavioral signals
Mouse movement, scroll behavior, and typing cadence are generated by physical interaction. A human moves the cursor in smooth arcs, pauses, and corrects direction. An automation script generates straight-line movements, exact-pixel stops, and mechanically consistent timing. Some advanced bots inject synthetic mouse events, but the timing distribution and acceleration curves remain machine-like under close analysis. Behavioral signals are collected at the page level, not at the network level, so they require JavaScript execution inside the page context.
TLS characteristics
The TLS handshake happens before JavaScript runs. A browser's ClientHello cipher suite order and extension list reflect the underlying TLS library, not the spoofed JavaScript properties. A Chromium-based bot can patch navigator.userAgent to say Chrome 124, but if its TLS library is not the real Chrome TLS stack, the handshake hash diverges. Tools such as utls and curl-impersonate exist to clone TLS fingerprints, but they require additional configuration that many automated pipelines do not apply. See TLS fingerprinting for a full breakdown of where this signal holds and where it does not.
Cross-session device identity
A spoofed canvas hash is new on every session if the attacker uses randomization. But the underlying GPU and font renderer produce consistent subtle artifacts that survive the randomization if the detector is measuring the right channel. Device intelligence that correlates multiple low-entropy signals across sessions can maintain identity through canvas and WebGL resets, catching the rotate-fingerprint-per-request pattern that single-attribute detectors miss.
Inconsistency fingerprints
A browser that claims to be Chrome 124 on Windows 11 with a 1920x1080 screen but renders WebGL output consistent with a 2020 MacBook Pro GPU is internally inconsistent. Detectors that cross-validate claimed attributes against actual rendering behavior catch inconsistent spoofing even when the spoofed values are individually plausible.
How cside resists browser fingerprint spoofing
cside's device intelligence collects 250+ signals across four layers: network, browser, device, and behavior. The collection runs inside a first-party JavaScript snippet that executes in real visitors' browsers on the live page, not from a scanner or crawler operating from a data-center IP.
Because the snippet runs in the actual browser context for a real page load, it sees behavioral signals that network-layer detectors never access. A bot that patches canvas and WebGL still generates machine-like mouse movement, scroll cadence, and click timing. The behavioral layer catches what the attribute-layer spoofing does not cover.
Cross-session device identity is maintained across fingerprint resets using correlations across the 250+ signals. A device that rotates its canvas hash and WebGL renderer per session still produces consistent hardware concurrency, consistent audio context precision, consistent font rendering artifacts, and consistent behavioral patterns. The aggregate correlation survives the rotation.
The collection is first-party: it rides in the customer's own JavaScript rather than loading as a third-party request. Ad-blockers and privacy browser lists that strip third-party fraud tags do not strip first-party scripts, so the detection does not go blind at the exact moment a fraud tool enables a privacy extension to avoid being fingerprinted.
For teams building fraud stacks, the practical outcome is that a fraud actor cannot defeat cside's device intelligence by downloading playwright-stealth and calling expect(page).to.be.a('RealBrowser'). They have to suppress behavioral anomalies, maintain TLS fingerprint consistency, and produce coherent cross-session device signals simultaneously. That combination of requirements is what raises the cost of automated fraud above what most fraud operations can sustain.
