HTTP header spoofing + cross-engine coherence (v1.2.0) #5

Merged

richard merged 1 commit from anti-detection-and-v1.1 into main

2026-08-19 23:52:46 +02:00

richard commented

2026-08-19 23:43:32 +02:00

Owner

Summary

Closes the largest remaining fingerprinting gap: the engine only rewrote what page JavaScript saw, while the browser still sent its real User-Agent, Accept-Language and Sec-CH-UA headers — a JS-vs-network mismatch that is itself a strong signal.

HTTP header layer (declarativeNetRequest)

Per-registrable-domain session rules keyed to the same per-site profile the MAIN-world engine uses, added lazily on navigation.
Rewrites User-Agent / Accept-Language; rewrites the sec-ch-ua trio for Chromium covers and strips it for Firefox/Safari; strips high-entropy client hints and DNT/Sec-GPC; per-engine Accept on document requests.
New permissions: declarativeNetRequest, webNavigation.

Cross-engine JS coherence

Engine-aware API presence (applyIdentityPresence), now applied when the real cover arrives instead of at install with the default profile (this was also a latent bug): deletes getBattery / connection / deviceMemory / userAgentData / window.chrome and other Chromium-only surfaces under Firefox/Safari covers; provides them coherently under Chromium; oscpu/buildID only for Firefox.
Intl locale coherence (resolvedOptions().locale) + v8BreakIterator removal.
screen.availLeft/availTop, window.screenLeft/screenTop.
enumerateDevices returns a fixed plausible device set instead of empty.
WebGL EXT_disjoint_timer_query hidden.

Known gaps (deliberately deferred, tracked separately)

Worker / OffscreenCanvas bypass — content script does not run in workers; needs its own branch + leak tests.
Tier E — cross-engine covers remain betrayed by Math libm precision, ICU version, JA3/JA4 etc.; constraining profiles to the host engine family is a product/ADR decision.

Test plan

npm run compile (tsc) clean
npm run build / npm run zip produce a valid MV3 zip (v1.2.0, new permissions present)
Load unpacked, verify amiunique/BrowserLeaks headers match the cover identity
Confirm Firefox covers no longer expose getBattery/window.chrome/userAgentData

## Summary Closes the largest remaining fingerprinting gap: the engine only rewrote what page **JavaScript** saw, while the browser still sent its real `User-Agent`, `Accept-Language` and `Sec-CH-UA` headers — a JS-vs-network mismatch that is itself a strong signal. ### HTTP header layer (declarativeNetRequest) - Per-registrable-domain session rules keyed to the **same** per-site profile the MAIN-world engine uses, added lazily on navigation. - Rewrites `User-Agent` / `Accept-Language`; rewrites the `sec-ch-ua` trio for Chromium covers and **strips** it for Firefox/Safari; strips high-entropy client hints and `DNT`/`Sec-GPC`; per-engine `Accept` on document requests. - New permissions: `declarativeNetRequest`, `webNavigation`. ### Cross-engine JS coherence - **Engine-aware API presence** (`applyIdentityPresence`), now applied when the *real* cover arrives instead of at install with the default profile (this was also a latent bug): deletes `getBattery` / `connection` / `deviceMemory` / `userAgentData` / `window.chrome` and other Chromium-only surfaces under Firefox/Safari covers; provides them coherently under Chromium; `oscpu`/`buildID` only for Firefox. - `Intl` locale coherence (`resolvedOptions().locale`) + `v8BreakIterator` removal. - `screen.availLeft/availTop`, `window.screenLeft/screenTop`. - `enumerateDevices` returns a fixed plausible device set instead of empty. - WebGL `EXT_disjoint_timer_query` hidden. ### Known gaps (deliberately deferred, tracked separately) - **Worker / OffscreenCanvas bypass** — content script does not run in workers; needs its own branch + leak tests. - **Tier E** — cross-engine covers remain betrayed by Math libm precision, ICU version, JA3/JA4 etc.; constraining profiles to the host engine family is a product/ADR decision. ## Test plan - [x] `npm run compile` (tsc) clean - [x] `npm run build` / `npm run zip` produce a valid MV3 zip (v1.2.0, new permissions present) - [ ] Load unpacked, verify amiunique/BrowserLeaks headers match the cover identity - [ ] Confirm Firefox covers no longer expose `getBattery`/`window.chrome`/`userAgentData`

richard added 1 commit

2026-08-19 23:43:32 +02:00

HTTP header spoofing + cross-engine coherence; bump to 1.2.0 40dffb8729

Close the largest remaining gap: the engine only rewrote what page
JavaScript saw, while the browser still sent its real User-Agent,
Accept-Language and Sec-CH-UA headers — a glaring JS-vs-network mismatch.

Header layer (declarativeNetRequest):
- Per-registrable-domain session rules keyed to the same per-site profile
  the MAIN-world engine uses, added lazily on navigation.
- Rewrites User-Agent / Accept-Language; rewrites the sec-ch-ua trio for
  Chromium covers and strips it for Firefox/Safari; strips high-entropy
  client hints and DNT/Sec-GPC; per-engine Accept on document requests.
- New permissions: declarativeNetRequest, webNavigation.

Cross-engine JS coherence:
- Engine-aware API presence (applyIdentityPresence), applied when the real
  cover arrives rather than at install with the default profile: deletes
  getBattery/connection/deviceMemory/userAgentData/window.chrome and other
  Chromium-only surfaces under Firefox/Safari covers, provides them
  coherently under Chromium; oscpu/buildID only for Firefox.
- Intl locale coherence (resolvedOptions().locale) + v8BreakIterator removal.
- screen.availLeft/availTop, window.screenLeft/screenTop.
- enumerateDevices returns a fixed plausible device set, not empty.
- WebGL EXT_disjoint_timer_query hidden.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

richard merged commit 070620a1a3 into main

2026-08-19 23:52:46 +02:00

richard deleted branch anti-detection-and-v1.1

2026-08-19 23:52:46 +02:00

richard referenced this pull request from a commit

2026-08-19 23:52:47 +02:00

Merge pull request 'HTTP header spoofing + cross-engine coherence (v1.2.0)' (#5) from anti-detection-and-v1.1 into main