Privacy company Brave is rolling out new protections that will reduce browser fingerprinting through WebGL and WebGPU, two of the APIs that can reveal information about your device's graphics hardware and drivers to websites.
"Starting in version 1.93, Brave is rolling out new protections against GPU and graphics-driver fingerprinting," the company has announced. The phased release applies to desktop and Android. Brave is built on Chromium; the post does not include its WebKit-based iPhone and iPad browser, and Brave describes the work as "de-identifying WebGL vendor and renderer strings" and "adding noise to the list."
The iPhone and iPad exception is due to Appke locking everything down to its own WebKit and not letting browser creators user their own engines.
MDN describes WebGL as "a JavaScript API for rendering high-performance interactive 3D and 2D graphics within any compatible web browser without the use of plug-ins." Associated queries can return the GPU vendor, renderer and supported extensions, details a tracking script can combine with other browser signals.
Brave’s earlier explanation says fingerprinting works by "building a large collection of things that are a little bit unique about your browser and environment." Its technical documentation calls the feature a "best-effort defense against browser fingerprinting" and defines the problem as "the detection of browser and operating system features that differ between users."
The first Brave implementation ticket recorded that the unprotected query returned "Google Inc. (Apple)" and "ANGLE Metal Renderer: Apple M5 Max, Unspecified Version."
WebGPU supplies another route, and its documentation says the API lets developers use the system’s GPU "to carry out high-performance computations and draw complex images that can be rendered in the browser." But Brave’s implementation note says GPUAdapterInfo "contains device specific information like vendor and architecture," fields that Brave 1.93 now removes.
WebKit reduces the corresponding WebGL results to "Apple Inc." and "Apple GPU," and gives generic Apple answers for WebGPU adapter information. Apple calls WebGPU "a JavaScript API for running programs on the GPU," and its release notes add, "Additionally, it adds compute shaders, which allow general purpose computations on the GPU." Brave discloses slightly less, although other browser signals still identify the operating system.
Brave will automatically configure this blocking behavior in a way that prevents breaking anything by doing it on a per-site basis. As expected, users can, if they want to, turn of these graphics-based protections and even disable fingerprinting protection completely.
