browser fingerprinting

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

2 months ago

Different OSes (Linux, macOS, Windows) cause browsers to produce slightly different floating-point results for certain math functions like Math.tanh due to differing underlying C math libraries (glibc, libsystem_m, UCRT).
This creates a fingerprinting vector, as anti-bot systems can detect OS by examining last-bit discrepancies in results from Math.tanh, CSS trig functions, and Web Audio compressor operations.
Chrome 148+ changed Math.tanh to use the host OS's std::tanh instead of V8's bundled fdlibm, introducing this leak; earlier versions do not have it.
Spoofing math correctly requires reproducing exact bit patterns per OS, considering library variations (e.g., Apple's scalar vs. Accelerate frameworks) and ensuring deterministic compilation without compiler optimizations affecting fused multiply-add.
Scrapfly's browser implements precise reproductions or lifts original libraries (e.g., mapping UCRT on Linux) to match claimed OS bit-for-bit, validated against real devices and browsers.