A Multi-Layered Approach to Browser Fingerprinting Evasion

Browser fingerprinting has largely supplanted cookies as the dominant tracking primitive, and the same techniques increasingly underpin anti-fraud, anti-bot, and forensic-evasion detection.

This paper presents a two-layer evasion architecture that synchronizes hypervisor-level hardware masking with browser-level JavaScript interception, and documents an iterative implementation of each layer measured against empirical detection instruments (CreepJS, BrowserLeaks).

Layer 1 hardens a KVM/QEMU virtual machine’s SMBIOS, CPUID, timing, and peripheral surface into an internally coherent consumer-laptop persona, validated directly against BrowserLeaks’ unmasked WebGL ren- derer report.

Layer 2 develops a Firefox Manifest V3 extension, denoted v0.1 through v0.3.1, that reduces CreepJS’s prototype-tampering lie count from 2,584 lies across 2,507 of 3,395 properties to zero—not through progressively more sophisticated spoofing, but through the reverse: each surface for which Layer 1 already supplies a coherent native value (WebGL parameters, font metrics, layout geometry) is ultimately best served by removing the JavaScript interception entirely, retaining hooks only where no native substitute exists (Canvas, Audio, WebRTC).

The result is a case study in the limits of application-layer fingerprint evasion, and an argument that hardware- and OS-level delegation, rather than deeper JavaScript spoofing, is the more sustainable strategy.

Implementation, configuration, and version history are available at https://gitlab.cylab.be/cylab/students/ fingerprinting-evasion.

Get the full report [PDF]

This blog post is licensed under CC BY-SA 4.0