Browser fingerprinting in Chrome: what websites actually see, and which extensions really help

If you spent the last few years assuming Chrome was quietly closing the loopholes that let websites identify you without cookies, I have some bad news. According to a detailed analysis published by The Register on April 16, 2026, privacy consultant Alexander Hanff catalogued at least 30 distinct fingerprinting techniques that still work in Chrome today — and Chrome ships with almost nothing to stop them.

That gap matters. Fingerprinting survives cookie clearing — and unlike a cookies-permission extension reading your session tokens, there's no permission you can revoke to stop it. It survives private browsing. It survives switching email addresses.

And the extensions you might install to help can sometimes make the problem worse, not better. So let's break down what Chrome actually leaks, what Brave and Firefox do differently, and which extensions are worth the trade-off.

What browser fingerprinting actually is

Browser fingerprinting is the technique a website uses to identify you without setting a single cookie. Instead of asking your browser "who are you?", the site reads dozens of small, technical details about your setup — and combines them into something almost as unique as a real fingerprint.

A 2025 Nature study cited in Hanff's analysis found that knowing just a user's four most-visited websites is enough to identify roughly 95% of people. Fingerprints don't need to be perfectly unique to work. They need to be stable and rich enough that a tracking system can match the same person across visits.

The frustrating part is that none of this requires a permission prompt. No banner appears. No "this site wants to identify you" dialog. The browser just answers questions that web APIs were designed to answer.

What Chrome actually leaks

Per Hanff's analysis in The Register, Chrome exposes at least 30 active fingerprinting vectors with no opt-out. A non-exhaustive list:

• Operating system and version
• Screen resolution and color depth
• Installed system fonts
• GPU model and graphics driver via WebGL
• Audio context properties (how your machine processes sound)
• Emoji rendering (different OSes draw the same emoji differently)
• Available device memory and CPU core count
• TLS handshake details
• Speech synthesis voices installed
• Keyboard layout
• Battery status (in some configurations)

Most of these are exposed through standard web APIs that any script on any page can read. A site doesn't need to ask. It just runs JavaScript on page load and quietly assembles your profile.

"There are at least thirty distinct fingerprinting techniques that work in Chrome right now, today, as you read this." — Alexander Hanff, The Register, April 16, 2026

The Register's piece is the first big roundup I've seen that lays out the policy backstory too. Google's Privacy Sandbox initiative, launched in 2019, originally promised system-level fingerprinting defenses, including a "Privacy Budget" cap on how much identifying data any one site could collect. Hanff notes those proposals were abandoned by April 2025, with no fingerprint-specific mitigations shipping in their place.

Google's stated stance shifted from calling fingerprinting "wrong" in 2019 to treating it as "acceptable if disclosed" by December 2024. Google has not publicly disputed the technical claims in Hanff's analysis as of publication.

What Brave and Firefox do that Chrome doesn't

Two other browsers take fingerprinting seriously enough to ship defenses by default or as an opt-in.

Brave uses a technique it calls "farbling." Instead of trying to remove fingerprinting APIs (which would break legitimate sites), Brave injects tiny, random noise into the answers each site receives. Your canvas pixel hash, your audio context output, your enumerated fonts — all get slightly perturbed, with a different perturbation per session and per site. The result is that fingerprinting scripts still get an answer, but a different one every time, making cross-site tracking far harder.

Firefox offers privacy.resistFingerprinting, an opt-in setting buried in about:config. When enabled, it standardizes a long list of API responses to a common default — every Firefox user with the setting on looks like the same generic Firefox user to fingerprinting scripts. It also blocks some APIs entirely (like the Battery Status API).

Chrome offers neither. The closest you'll get is enabling "Send a 'Do Not Track' request" — which sites are free to ignore, and most do.

What extensions can really do about it

This is the part most readers care about: if my browser won't protect me, can an extension fix it?

Honest answer: partially, with caveats. Here's the lay of the land.

Canvas and WebGL spoofing extensions (e.g. CanvasBlocker on Firefox, similar tools on Chrome) override the canvas and WebGL APIs in your tabs to return either blank or randomized output. These can defeat the most common single-vector fingerprinting trick, but they don't cover the other 25-plus vectors Hanff catalogued. A site that combines canvas, audio, font enumeration, and TLS data still wins.

Anti-tracking extensions (uBlock Origin, Privacy Badger, DuckDuckGo Privacy Essentials) primarily block requests to known tracker domains. They're great at stopping the delivery of tracking data to known third parties. They generally don't change what the page itself can read locally before sending anything. If the fingerprinting script runs first-party — like the LinkedIn case I covered in my earlier piece on extension fingerprinting — block lists don't help.

User-agent and header spoofing extensions rotate the User-Agent string sites see. Useful in narrow cases, but trivially defeated by any modern fingerprinting library, which checks dozens of other signals to detect that the User-Agent doesn't match the actual browser.

The trade-off worth being honest about: every spoofing extension you install becomes part of your fingerprint. A Chrome user with three obscure anti-fingerprinting extensions installed is more identifiable, not less, because the combination of "Chrome + these specific spoofers" is itself unusual. The fingerprint just shifts category — from "your hardware" to "your defensive toolkit."

When fingerprinting is okay, and when it's not

Not every fingerprint check is hostile. A banking site checking that the browser fingerprint matches your last login is a reasonable fraud signal. An anti-bot service detecting that a "user" presents impossible combinations of properties (Linux user agent, Windows fonts, mobile screen) is doing exactly what it's supposed to.

The line, in my view, sits at three questions:

1. Is the fingerprint scoped to a single site, or shared across the web? First-party use for session protection is defensible. Selling or syndicating fingerprints to ad networks is something else.
2. Is the user told? "We use fingerprinting to detect fraud" buried in clause 14.b of a privacy policy is technically disclosure and morally not.
3. Can the user opt out without breaking the service? If the answer is no, the fingerprint has crossed from security into surveillance.

By those three questions, the broader ad-tech ecosystem fails on all counts. The Register's piece argues — and I agree — that's why Chrome shipping no defenses by default is a policy choice, not a technical limitation.

How to check what your setup actually leaks

If you want to see your own fingerprint, the EFF's Cover Your Tracks tool (coveryourtracks.eff.org) runs a real test and shows you a rarity score. It's the least painful way to learn whether your browser stands out.

For your installed extensions specifically, the question isn't only "can a website see this extension is installed" — it's also "what does this extension's manifest expose, and what does it do with the data it collects?" That's where Extenshi's catalog comes in. You can search the catalog for any extension you have installed and see its manifest, declared permissions, and any flagged tracker behaviour. Privacy-focused alternatives in the same category are a couple of clicks away.

If you're serious about reducing exposure:

• Switch to Brave or Firefox for sessions where being tracked actually matters (banking, healthcare, job hunting).
• Treat anti-fingerprinting extensions as targeted tools, not blanket defenses. Pick one or two that address the specific vectors you care about.
• Prune extensions you don't actively use. Every extension is a potential signal — and as my tally of permissions across 308,000 listings shows, a surprising share hold far more reach than their job needs.
• Run Cover Your Tracks once a quarter to see whether your setup has gotten more or less identifiable.

The uncomfortable conclusion of Hanff's piece, and the one I'd land on too, is that Chrome's current architecture makes meaningful fingerprinting resistance an exercise in workarounds. Until that changes, the best you can do is reduce your exposure surface and pick the right browser for the right job.

Check your permissions →

See which extensions in your browser are quietly contributing to your fingerprint — and which ones might actually be helping.

---

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].