Brave Blocks GPU Fingerprinting

Brave browser has rolled out new protections designed to thwart GPU fingerprinting, a sophisticated tracking technique that uses graphics card and driver information to uniquely identify users across the web. Starting with version 1.93, the browser now modifies the data exposed by WebGL and WebGPU APIs, making it harder for trackers to build persistent user profiles.

These APIs, while essential for rendering hardware-accelerated graphics and enabling richer web experiences, also offer a treasure trove of device-specific data. Trackers can glean details like the exact GPU model, driver version, and supported features. Brave's approach, detailed in their privacy updates blog, involves de-identifying vendor and renderer strings and adding randomization to the list of supported extensions. These changes are enabled by default on desktop and Android versions.

The Hidden Fingerprint in Graphics

Browser fingerprinting is a persistent threat to user privacy, operating independently of cookies. By combining numerous small signals, trackers can create a unique identifier for a user that follows them online. Graphics APIs like WebGL and WebGPU are particularly valuable targets because the information they expose about a user's hardware is generally stable. For instance, a script can query for detailed strings like 'ANGLE (Apple, ANGLE Metal Renderer: Apple M5 Max)' or a full list of supported extensions, which vary significantly based on the GPU and driver.

The newer WebGPU API offers similar insights, reporting adapter descriptors such as vendor and architecture. Brave's internal analysis of top websites revealed that a significant portion of these APIs were being used primarily for fingerprinting rather than core functionality.

Brave's Defense Strategy

To combat this, Brave is implementing several key changes. Vendor and renderer strings from WebGL will be replaced with a single, generic string for all users. WebGPU adapter descriptors will be emptied. Crucially, Brave is injecting randomization into the WebGL extension list, ensuring that fingerprinting algorithms see a different value per session, per site, and per storage area. This aims to deny trackers a stable identifier while preserving the ability for websites to render graphics correctly.

These protections have been tested across Brave's Nightly and Beta channels over recent months. The company acknowledges that while the goal is to avoid breaking websites, they have mechanisms to adjust protections on a per-site basis if genuine compatibility issues arise. Users also retain control, with the ability to disable these specific graphics protections or turn off Brave Shields entirely.

Privacy for Everyone

Brave has long positioned itself as a leader in privacy-focused browsing, with its default-enabled protections standing out. Many other browsers offer privacy features as opt-in options or behind experimental flags, or implement them in ways that can break website functionality. Brave argues that strong privacy should not require expert knowledge or compromise user experience. This latest move further solidifies their commitment to providing comprehensive privacy protections out-of-the-box.

The company's efforts extend beyond just blocking trackers. Brave also protects against state-based tracking like cookies and blocks known malicious scripts and resources, aiming for a holistic approach to privacy, security, and performance. Future work includes plans to randomize WebGPU's supported extensions as well.

StartupHub.ai data indicates Brave holds a score of 63/100, placing it ahead of general web browsing technology (22/100) but behind specialized privacy solutions like StarkWare (73/100). Competitors such as LayerX (58/100) and Octen (54/100) are also active in related privacy domains.