Fingerprint override

Entitlement: fingerprintOverride. EP: internal.fingerprint_override. This is startup configuration; there is no chrovia.fingerprint JS domain. Fully quit and restart the instance after changing these settings.

Start with a coherent configuration

This Windows-oriented example leaves GPU and voice data unspecified rather than inventing a complete device profile:

{
  "internal": {
    "fingerprint_override": {
      "noise_seed": "123456789",
      "browser_version": "151.0.0.0",
      "platform": "windows",
      "platform_version": "10.0.0",
      "architecture": "x86",
      "hardware_concurrency": 8,
      "device_memory": 8.0,
      "device_pixel_ratio": 1.0,
      "timezone": "America/Los_Angeles",
      "accept_languages": "en-US,en",
      "webrtc_ip_policy": "disable_non_proxied_udp",
      "screen": {
        "width": 1920,
        "height": 1080,
        "available_width": 1920,
        "available_height": 1040
      },
      "media_device_counts": {
        "audio_input": 1,
        "audio_output": 1,
        "video_input": 0
      },
      "geolocation": { "disabled": true }
    }
  }
}

Merge into the instance EP, sign if required, and launch. Adapt values to the identity you intend to model. Changing the reported browser version does not install another Chromium engine or change its actual feature support.

Identity and hardware fields

Missing or rejected values generally leave the corresponding native behavior. Hardware hints do not allocate physical CPUs or RAM. Platform overrides are not OS virtualization. Keep UA/client hints, GPU, language, and screen values consistent with the intended environment.

Locale, screen, and network privacy

Reported screen dimensions are not a command to resize the actual desktop. WebRTC policy is not an egress proxy; configure system proxy override separately. Locale changes affect browser-exposed language data but are not a translation of your web application.

Geolocation

Use {"disabled": true} to provide a denied geolocation result. To override position instead, provide latitude from -90 to 90, longitude from -180 to 180, and non-negative accuracy. Optional fields are altitude, non-negative altitude_accuracy, heading from 0 to 360, and non-negative speed.

This changes location results, not the physical device or network address. Do not assume overriding a position bypasses ordinary site permission checks.

Device, font, and voice lists

media_device_counts accepts audio_input, audio_output, and video_input. Non-negative integers are capped at 32; missing/negative values leave a type unchanged. Counts are adjusted only before the relevant device permission is granted. This does not create working microphones or cameras.

font_allowlist is an array of non-empty font-family strings, compared case-insensitively. An empty list leaves filtering inactive. It filters system font resolution; it does not install fonts or remove every web font. Supply font names actually available for your target environment.

speech_voices is an array of voice objects with at least string name and lang fields. Optional voice_uri defaults to name; optional boolean local_service defaults to true. The first usable entry is the default voice; there must be at least one usable entry. For example: [{"name":"Example voice","lang":"en-US","voice_uri":"example-voice","local_service":true}]. Replace these sample values with voices available in your reference environment; renaming a voice does not install a speech engine.

GPU profile

gpu_profile is an object with collected sections, not a string profile ID. Its supported layout includes:

Supply numeric values as JSON numbers, not numeric strings. Range values are two-number arrays; MAX_VIEWPORT_DIMS is a two-integer array. Identity values are strings. The supported WebGL keys are:

Put ordinary numeric limits in params, floating-point ranges/limits in float_params, extension limits in ext_params, and identity strings in strings. If a key is repeated within a section, precedence from lowest to highest is params, float_params, ext_params, then strings. If the same key appears under both webgl1 and webgl2, the webgl2 value wins wherever that query supports overrides. These sections do not provide independent conflicting identities. MAX_COLOR_ATTACHMENTS and MAX_DRAW_BUFFERS are overridden in WebGL 2; WebGL 1's WEBGL_draw_buffers queries retain native values. Extension queries still require the corresponding extension to be available and enabled.

For webgpu.limits, use integral JSON numbers from 0 through 4294967295, except maxUniformBufferBindingSize, maxStorageBufferBindingSize, and maxBufferSize, which accept larger integral numbers. Keep those three within JavaScript's safe integer range (at most 9007199254740991). Larger values are not safely preserved. Use values consistent with the reference device:

webgpu.info supports:

Some adapter information is available only when the browser exposes the corresponding developer features. Setting a value does not make an unavailable WebGPU API or property appear.

To prepare a small profile without inventing values, run this on a trusted page in the target reference browser, before applying overrides:

const gl = document.createElement('canvas').getContext('webgl2');
if (!gl) throw new Error('WebGL 2 is unavailable');
const gpuProfile = {
  webgl2: {
    params: {
      MAX_TEXTURE_SIZE: gl.getParameter(gl.MAX_TEXTURE_SIZE),
      MAX_VIEWPORT_DIMS: Array.from(gl.getParameter(gl.MAX_VIEWPORT_DIMS)),
    },
    float_params: {
      ALIASED_LINE_WIDTH_RANGE: Array.from(gl.getParameter(gl.ALIASED_LINE_WIDTH_RANGE)),
    },
    internalformat_samples: {
      '0x8058': Array.from(gl.getInternalformatParameter(gl.RENDERBUFFER, gl.RGBA8, gl.SAMPLES)),
    },
  },
};
console.log(JSON.stringify(gpuProfile, null, 2));

Use the output object as internal.fingerprint_override.gpu_profile, not as the whole EP document. This example deliberately collects only a few fields; add the supported fields you need from the same reference environment. Obtain updated signed preferences if required, fully restart, and repeat those queries in the target instance.

Unknown field names do not provide an override. Follow the documented types and ranges rather than relying on malformed values to fall back safely; non-integer sample-array entries can become zero. Use a coherent profile, not an arbitrary vendor string mixed with unrelated limits. Reporting a limit does not increase GPU resources or guarantee the underlying driver supports a workload.

Noise and verification

noise_seed accepts a decimal string from "0" through "18446744073709551615", or a JSON integer from 0 through 2147483647. Prefer a decimal string to preserve large values without JavaScript number precision loss. Omit it or use "0" to disable the seed-controlled noise protections; use a positive seed to enable them. It affects supported rendering, audio, and geometry fingerprint results. Keep a seed stable for a persistent identity; choose another for a different identity.

On a controlled page inspect navigator.hardwareConcurrency, navigator.deviceMemory, devicePixelRatio, screen.width, navigator.languages, and Intl.DateTimeFormat().resolvedOptions().timeZone. Check GPU/device/voice surfaces separately and compare before and after a full process restart. An API-only page does not need unrestrictedApi just to read these standard web properties.

This capability is not a guarantee of uniqueness, anonymity, or acceptance by any site's detection system. Verify the actual surfaces your application depends on rather than treating a valid EP as proof of a coherent fingerprint.