How CloakBrowser's Source-Level C++ Fingerprint Patches Function

CloakBrowser embeds anti-fingerprinting logic directly into the Chromium C++ source code, compiling patches into the browser binary that intercept API calls at the process level using command-line flags, making the spoofing indistinguishable from native browser behavior.

CloakHQ/CloakBrowser moves beyond traditional JavaScript-based stealth techniques by embedding fingerprint randomization directly into the browser's native code. These source-level C++ fingerprint patches compile into the Chromium binary itself, enabling the browser to return modified values for navigator.hardwareConcurrency, canvas fingerprints, and WebGL vendor strings without executing any client-side JavaScript overrides.

Core Architecture of C++ Fingerprint Patches

Fingerprint Seed Initialization

The patching system begins with a randomized seed that determines consistent but fake fingerprint values for each browser session. In cloakbrowser/config.py, the get_default_stealth_args() function (lines 40-62) generates a random integer between 10000 and 99999 and formats it as the --fingerprint=<seed> command-line argument.

This seed propagates through approximately 50 C++ patches embedded in the Chromium source. When the patched binary launches, it reads this flag during initialization and uses the seed to deterministically generate fake hardware profiles, screen dimensions, and browser capabilities that remain consistent throughout the session.

Platform-Specific Profile Mapping

The patches support cross-platform profile spoofing through the --fingerprint-platform flag. The same get_default_stealth_args() function (lines 54-61) appends either --fingerprint-platform=macos or --fingerprint-platform=windows based on the execution environment.

This allows a Linux or Windows host to present macOS GPU and user-agent characteristics at the binary level, or vice versa. Because these values are hardcoded into the compiled Chromium source rather than injected via JavaScript, detection scripts cannot identify the spoofing through property enumeration or prototype analysis.

Native API Value Substitution

Once activated by the presence of any --fingerprint* flag, the C++ patches intercept return values from native browser APIs before they reach the JavaScript context. The patches modify responses for navigator.maxTouchPoints, GPURenderer, canvas pixel data, WebGL vendor strings, and screen dimension queries.

Because these modifications occur within the browser process itself, the fabricated values appear authentic to JavaScript execution contexts. No properties are overwritten or wrapped, eliminating the signatures typically associated with puppeteer-stealth or playwright-stealth plugins.

Flag-Based Configuration System

Stealth Argument Generation

The high-level Python API translates user preferences into binary flags that activate specific patches. The build_args() function in cloakbrowser/browser.py (lines 38-86) merges default stealth arguments with user-provided configuration, constructing the final chrome_args list passed to Playwright.

This architecture separates patch activation from automation logic, allowing developers to toggle entire categories of fingerprint spoofing by adding or removing flags without modifying underlying patch code.

Geolocation and Locale Spoofing

Beyond hardware fingerprints, the C++ patches handle timezone and locale spoofing at the OS level. When launch() receives timezone or locale parameters, build_args() injects --fingerprint-timezone=<tz> and --fingerprint-locale=<locale> flags.

These patches intercept calls to Intl.DateTimeFormat().resolvedOptions().timeZone and navigator.language, returning the spoofed values instead of system defaults. This prevents IP-to-timezone mismatches that commonly trigger bot detection systems.

WebRTC IP Masking

The maybe_resolve_geoip() and _resolve_webrtc_args() functions (lines 99-135 of cloakbrowser/browser.py) handle IP spoofing through the --fingerprint-webrtc-ip=<ip> flag. When set to auto or a specific IP address, the C++ patches replace real ICE candidate addresses with the supplied value during WebRTC negotiation.

This prevents local IP address leakage while maintaining functional WebRTC capabilities, a common failure point in JavaScript-based privacy extensions.

Integration with Automation Frameworks

CloakBrowser's Python and JavaScript wrappers interface with Playwright through standard launch arguments. The launch() and launch_context() functions (lines 14-46 of cloakbrowser/browser.py) construct the argument array and pass it to Playwright's chromium.launch(), which executes the patched binary.

Because the patches reside in the binary itself, no additional JavaScript execution is required after page load. This eliminates the timing discrepancies and execution traces associated with page.evaluate() stealth scripts.

Practical Implementation Examples

Basic Launch with Default Patches

from cloakbrowser import launch

# Generates random fingerprint seed automatically via --fingerprint flag

browser = launch()
page = browser.new_page()
page.goto("https://protected-site.com")
browser.close()

Custom Seed and Platform Profile

browser = launch(
    stealth_args=True,
    extra_args=["--fingerprint=12345"],  # Fixed seed for reproducibility

    extra_args=["--fingerprint-platform=windows"]  # Force Windows profile on macOS

)

Timezone and Locale Configuration

browser = launch(
    timezone="America/New_York",  # Injects --fingerprint-timezone=America/New_York

    locale="en-US"               # Injects --fingerprint-locale=en-US

)

WebRTC IP Spoofing with Proxy

browser = launch(
    proxy="http://user:pass@proxy.example.com:8080",
    geoip=True,  # Resolves timezone/locale from proxy IP via maybe_resolve_geoip()

    extra_args=["--fingerprint-webrtc-ip=auto"]  # Replaces local IP with exit node

)

Persistent Context with Stealth (JavaScript)

import { launch_persistent_context } from "cloakbrowser";

const context = await launch_persistent_context("./my-profile", {
  headless: false
  // Stealth args added automatically by patched binary
});

const page = await context.newPage();
await page.goto("https://example.com");
await context.close();

Summary

• Source-level patching: CloakBrowser modifies Chromium C++ source to compile approximately 50 fingerprint patches directly into the browser binary, eliminating JavaScript injection detection vectors.

• Flag-driven activation: The get_default_stealth_args() and build_args() functions in cloakbrowser/config.py and cloakbrowser/browser.py translate Python parameters into --fingerprint* command-line flags that activate specific patch sets.

• Platform flexibility: The --fingerprint-platform flag enables cross-platform profile spoofing (e.g., Windows characteristics on macOS hosts) at the binary level.

• Comprehensive coverage: Patches intercept navigator.hardwareConcurrency, canvas APIs, WebGL strings, screen dimensions, timezone queries, and WebRTC ICE candidates before they reach JavaScript execution contexts.

• Framework integration: Patch activation occurs through standard Playwright/Puppeteer launch arguments, requiring no post-launch JavaScript execution to maintain stealth.

Frequently Asked Questions

How do CloakBrowser's C++ patches differ from JavaScript stealth libraries?

Traditional stealth libraries overwrite JavaScript prototypes after page load, leaving detectable traces in navigator.webdriver or property descriptors. CloakBrowser's C++ patches modify return values at the browser process level, so JavaScript execution contexts see native values that cannot be distinguished from unmodified Chrome. This eliminates the timing inconsistencies and forensic artifacts associated with runtime injection.

What happens if I run the patched Chromium binary without flags?

The C++ patches remain dormant unless the binary detects a --fingerprint or related flag on startup. Without these flags, the browser operates as standard Chromium without any fingerprint spoofing. This failsafe ensures the patched binary maintains compatibility with standard use cases when stealth is not required.

How does the fingerprint seed ensure consistency across sessions?

The seed passed via --fingerprint=<seed> serves as a deterministic input for the patch algorithms. When the same seed is provided, the C++ patches generate identical hardware profiles, screen resolutions, and canvas fingerprints. This allows automation scripts to maintain persistent fingerprints across browser restarts by saving and reusing the seed value, or to randomize fingerprints by generating new seeds per session.

Where are the patch definitions located in the repository?

The Python wrappers that construct activation flags reside in cloakbrowser/config.py (lines 40-62) and cloakbrowser/browser.py (lines 38-86). The C++ patch implementations themselves compile into the binary shipped with the repository. According to CHANGELOG.md, the current release includes approximately 57 source-level fingerprint patches for canvas, WebGL, audio, GPU, screen metrics, and WebRTC handling.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}