Build1 publisher3 min readPublished
Chrome's canvas still returns a device-specific hash with no noise injection
A dev.to audit of browser fingerprinting in 2026 rates canvas as still working on about 80% of browsers, while the signals Chrome's Privacy Sandbox froze are mostly declarative fields that automation frameworks already set by hand.
The Engineer · Build desk
What happened
- Chrome has frozen the User-Agent string since version 107 in late 2022, pinning OS version to Windows NT 10.0 and dropping minor version and OS build detail, with Firefox and Safari following.
- navigator.plugins and navigator.mimeTypes now return a fixed generic array in Chrome and Firefox, replacing the per-machine plugin list that once identified a visitor by their Flash and Java versions.
- Firefox has injected canvas noise since version 113 through the privacy.resistFingerprinting preference, which ships off by default and switches on in strict privacy mode and private windows.
- The audit's verdict is that canvas fingerprinting still works on roughly 80% of browsers, and it expects that share to keep falling.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint A hash that changes on every page load costs a detector the join, not just entropy: a returning Firefox private-window visitor counts as a new device each time, on exactly the traffic a fraud team most wants to link.
- cost The 80% is someone else's browser population. If your users skew toward Brave and strict-mode Firefox, the missing fifth turns into false negatives your review queue absorbs.
- contradiction The same audit says Chrome froze half the signals and rates Chrome the highest-fidelity canvas target, so the erosion has hit the cheap declarative fields and not the GPU-dependent hash.
- decision Anyone maintaining a detection stack now has to choose between paying engineers to keep declarative JavaScript checks current and moving the durable checks below the API surface, where stealth plugins cannot answer for them.
A frozen field and a randomized one break a detector in different places. Frozen fields are still readable; they just say the same thing to everyone. `navigator.platform` returns a generic value like `Win32` regardless of the actual architecture, and the Client Hints replacement, `navigator.userAgentData.platform`, is designed for lower entropy and gates the detailed values behind a permission request [7]. Noise is the harder case. With `privacy.resistFingerprinting` enabled, the same device produces a different canvas hash on every page load [9]. Two visits from one browser then arrive as two devices.
Canvas fingerprinting draws a complex scene, reads back the pixel data and hashes it; GPU hardware, driver versions, font rendering and anti-aliasing shift the output across devices [20]. Chrome perturbs none of it. The audit rates Chrome's canvas output as consistent and device-specific, with no noise injection, and calls it the highest-fidelity target [8]. Safari applies minimal canvas protection and is still stable [10]. The browser whose Privacy Sandbox froze or removed half the signals fingerprinting libraries depended on [1] left the expensive one alone.
The 80% verdict describes the browser mix in front of whoever ran the audit. Brave aggressively randomizes canvas by default, which the post calls effectively useless against Brave users [11], and Firefox's noise arrives only in strict privacy mode and private windows [9]. For that share to hold on your traffic, your proportion of Brave users and strict-mode Firefox sessions has to match theirs. On the remaining one in five [19], the fallbacks are thin: a 1920x1080 display at 1x describes tens of millions of devices, and Playwright and Puppeteer set an arbitrary viewport in one line [17]. Font lists still separate Windows from macOS from Linux, and the audit says their days as a high-entropy identifier are over, citing OS standardization, web font dominance, and a fixed list under `resistFingerprinting` [16].
For bot detection the frozen User-Agent costs less than it appears to. The audit calls the string worse than useless for that job, because every automation framework sets whatever value it wants [5]. The same reasoning covers the rest of the declarative surface: `navigator.plugins` and `navigator.mimeTypes` return a fixed generic array in Chrome and Firefox, and the post says to remove those checks from any library that still runs them [6]. What moved against detection is spoofing quality, and the audit says headless browser frameworks have got dramatically better at faking what remains [3].
The post's summary says JavaScript-accessible signals are eroding while network-level signals are ascendant, and places the most durable 2026 techniques below the browser's API surface, where privacy extensions and stealth plugins cannot reach [13]. It rates each technique on entropy and durability [15], and it does not publish traffic measurements behind that trend [21]. It also sets the boundary for the whole exercise: a fingerprint is not a durable cross-browser identity, and no single fingerprint should be treated as proof that a visitor is human or automated [14].
What to watch
- Whether Chrome ships canvas noise on by default, the single change that would move the 80% figure most.
- Whether Mozilla turns privacy.resistFingerprinting on outside private windows and strict mode, making noise the Firefox baseline.
- Any published measurement comparing network-layer signal with canvas hashes on real production traffic.