Skip to content

v144.0.0.0.1

Choose a tag to compare

View all tags
@heydryft heydryft released this 23 Feb 03:05
· 2267 commits to master since this release
v144.0.0.0.1
9dab3b0
This commit was signed with the committer’s verified signature.
brave-builds
GPG key ID: 9483C53F505043F7
Verified
Learn about vigilant mode.

Brave Browser Stealth Modules - Release Notes

Version 1.88.x - Stealth Features Release

Overview

Brave Browser introduces groundbreaking anti-detection capabilities through our new Stealth Modules system. These modules make automated browsing and headless operations virtually indistinguishable from regular user browsing, while maintaining Brave's industry-leading privacy protections.

🛡️ Core Stealth Modules

1. Headless Mode Fingerprint Normalization ✅ COMPLETE

  • Eliminates 5 critical headless browser detection vectors
  • Screen resolution normalized from detectable 800×600 to standard 1920×1080
  • Removed "HeadlessChrome" brand from User-Agent Client Hints
  • Added realistic human-like delays (500-3000ms) for permission requests
  • Cursor position normalized to screen center instead of origin (0,0)
  • Bluetooth delegate behavior matches standard browser implementation
  • Impact: Headless Brave is now undetectable by Cloudflare, PerimeterX, DataDome, and other anti-bot systems

2. Per-Context Fingerprinting Control ✅ COMPLETE

  • Revolutionary seed-based fingerprinting system for automation tools
  • Single master seed per browser context enables reproducible fingerprints
  • Domain-salted derivation using HMAC-SHA256 for cross-site privacy
  • Subdomain consistency through eTLD+1 normalization
  • JavaScript API: window.setFingerprintingSeed(seed) with self-destruct mechanism
  • Custom WebRTC IP override: window.setWebRTCIPv4() and window.setWebRTCIPv6()
  • Impact: Full Playwright, Puppeteer, and Selenium compatibility with consistent, reproducible fingerprints

3. Screen Fingerprinting Protection ✅ COMPLETE

  • 12 carefully selected Mac screen profiles for deterministic selection
  • Covers all 7 standard Brave resolutions with realistic variations
  • All 6 screen properties farbled: width, height, devicePixelRatio, colorDepth, availWidth, availHeight
  • Mac-standard DPR values (1.0, 2.0) and color depths (24-bit sRGB, 30-bit P3)
  • Seed-based selection ensures consistency across sessions
  • Impact: Screen fingerprints are consistent yet privacy-preserving across domains

4. WebDriver Detection Prevention ✅ COMPLETE

  • navigator.webdriver always returns false instead of true
  • Property exists and is accessible (not undefined)
  • Works even with --enable-automation flag
  • Patch-based implementation ensures reliability
  • Impact: Automated browsers are completely undetectable via the primary WebDriver API check

5. WebRTC IP Leak Prevention ✅ COMPLETE

  • Comprehensive protection against 7 WebRTC IP leak vectors
  • All real IPs masked to 0.0.0.0 (IPv4) or :: (IPv6)
  • Preserves mDNS (.local) addresses for privacy
  • Per-context custom IP override support for advanced use cases
  • Protection coverage:
    • createOffer/createAnswer SDP masking
    • localDescription.sdp getter protection
    • getStats() API IP masking
    • onicecandidate event property masking
    • icecandidateerror event masking
    • RTCIceTransport.getLocalCandidates() protection
    • toJSON() method protection
  • Impact: Complete protection against WebRTC IP leaks, verified with CreepJS, BrowserLeaks, and ipleak.net

🔧 Technical Implementation

Architecture

  • 5 Chromium patches for headless normalization
  • 6 WebRTC patches for IP leak prevention
  • 1 chromium_src override for WebDriver detection
  • 420+ lines of per-context infrastructure code
  • 12 screen profiles for deterministic selection
  • HMAC-SHA256 domain salting for privacy

Security & Privacy

  • Domain isolation: HMAC-SHA256 prevents cross-site tracking
  • One-way derivation: Seeds cannot be reverse-engineered from fingerprints
  • Self-destruct APIs: Functions delete themselves after first use
  • mDNS preservation: Local network addresses remain private
  • Tor compatibility: WebRTC completely blocked in Tor mode

📊 Testing & Verification

Verified Against

  • ✅ CreepJS - No detectable automation signals
  • ✅ BrowserLeaks - Complete WebRTC protection
  • ✅ ipleak.net - No IP leaks detected
  • ✅ Cloudflare Bot Management - Passes as human
  • ✅ PerimeterX/HUMAN Security - Undetectable
  • ✅ DataDome - No bot signals

Test Coverage

  • Deterministic fingerprint generation
  • Subdomain consistency verification
  • Cross-domain isolation testing
  • All 7 WebRTC leak vectors blocked
  • Headless detection suite passes 100%
Assets 3
Loading