Brave is rolling out new protections to reduce browser fingerprinting through WebGL and WebGPU, two APIs that can expose detailed information about a device's graphics hardware and drivers.
The protections are enabled by default on desktop and Android and are being introduced gradually after testing in Brave's Nightly and Beta channels.
GPUs as fingerprinting signal
WebGL and WebGPU allow websites to use hardware-accelerated graphics for games, maps, 3D content, and other demanding applications. However, they can also reveal information that helps trackers distinguish one device from another.
Websites can query details such as the GPU vendor and model, graphics driver information, supported features, and the list of available extensions. Because these characteristics usually remain stable over long periods, they can contribute to a persistent browser fingerprint even when cookies are blocked or deleted.
Brave says a small crawl of popular websites found that most observed use of these graphics-related queries was exclusively for browser fingerprinting.
One example is WebGL's renderer information, which can expose highly specific strings such as ANGLE (Apple, ANGLE Metal Renderer: Apple M5 Max), revealing details about the underlying graphics hardware.
WebGL's getSupportedExtensions() method also returns a list that varies by GPU and driver. Trackers can hash that list into a compact identifier. WebGPU provides similar hardware descriptors through fields such as vendor, architecture, and device.
Masking and randomizing graphics data
Brave 1.93 introduces three changes designed to make these signals less useful for tracking.
The browser now replaces WebGL vendor and renderer strings with a generic value shared across Brave users, preventing sites from directly learning the actual GPU model through those fields.
It also empties WebGPU adapter descriptors that would otherwise expose hardware details.
Finally, Brave adds randomization to the WebGL extension list so fingerprinting scripts see different values depending on the session, site, and storage area. Site separation is based on eTLD+1, roughly corresponding to the registrable domain such as example.com.
This makes extension-list hashes less useful as stable identifiers while preserving the APIs needed for legitimate graphics rendering.
The new system will be enabled by default on Brave 1.93, but those who haven't received the roll-out yet may still force-enable it from the browser's experimental features settings.
Compatibility and future work
Brave says the changes were designed to reduce fingerprinting without disabling WebGL or WebGPU, which could break games, 3D applications, maps, and other sites that depend on GPU acceleration.
If compatibility issues arise, Brave can adjust protections on a per-site basis. Users can also disable the graphics protections for an affected site, turn off fingerprinting protection, or disable Shields.
Users can verify what their browser exposes using the Electronic Frontier Foundation's Cover Your Tracks service. Once the feature is active, WebGL vendor and renderer fields should show generic values rather than detailed hardware information.
Brave also plans to extend the same approach to the extensions supported by WebGPU.
For most users, no action is required beyond keeping Brave updated. The roll-out is gradual and will be completed in the coming days.
Leave a Reply