Skip to content

The open-source rebrowser-patches alternative

rebrowser-patches did important work on Puppeteer and Playwright's Runtime.enable leak, and its bot-detector page is still a useful test. But the patched packages were last released in May 2025 and only cover the driver. Clearcote handles the CDP side at launch and in the engine, and changes the fingerprint too.

Get it freeRead the docs

What is rebrowser-patches?

rebrowser-patches is a set of source patches for Puppeteer and Playwright, with ready-made drop-in packages (rebrowser-puppeteer, rebrowser-playwright). The main patch fixes the Runtime.enable leak, with three switchable strategies: a main-world binding, always-isolated worlds, or enable-then-disable. Smaller patches rename Puppeteer's pptr: sourceURL and its utility world. The team's write-up on the leak and their open bot-detector page are some of the best public material on the subject.

The limits are scope and freshness. Its own README calls patching library source fragile, since it can break as upstream changes. The drop-in packages were last published in May 2025, at Puppeteer 24.8.1 and Playwright 1.52.0; upstream has since reached Puppeteer 25.11 and Playwright 1.63. And like every driver patch, it leaves the browser stock: the fingerprint is the host's.

Clearcote vs rebrowser-patches

FeatureClearcoterebrowser-patches
Approach Engine-level C++ patches Patches to the Puppeteer / Playwright source
Runtime.enable leak Neutralized in the engine; isolated worlds at launch Fixed in the driver (three modes)
Fingerprint identity Coherent persona from a seed Your host's real values
Library versions Works with current official Puppeteer & Playwright Pinned to Puppeteer 24.8.1 / Playwright 1.52.0
Last release Active May 2025
TLS / network ClientHello follows the persona's Chrome version Whatever the local Chrome sends
Languages Python, Node, .NET Node (Puppeteer, Playwright), Python (Playwright)
Cost Open build free; latest build free with GitHub; Pro $49/mo Free & open

Comparison compiled September 2026. rebrowser-patches is open source (mit patches; apache-2.0 builds); details change — check its project for the latest.

Why teams pick Clearcote

No patched library to wait for

Clearcote works with the official Puppeteer and Playwright packages, so you're not pinned to the last version a patch set was rebased onto.

The fingerprint, not only the session

Fixing Runtime.enable hides the automation session. Clearcote also changes the canvas, WebGL, fonts, screen and hardware the page reads.

Handled below the library

Clearcote's CDP handling lives in the engine and launch defaults, so it doesn't depend on patching each release of a JavaScript library.

Coherent down to TLS

The claimed Chrome version carries through to the TLS ClientHello, a layer a library patch can't reach.

When rebrowser-patches might be the better pick

  • You're pinned to Puppeteer 24 or Playwright 1.52 anyway and only need the Runtime.enable fix.
  • You want to study the patches: they are short, well documented and a good way to understand the leak.
  • For a maintained patched Playwright, Patchright is the actively updated option in the same category.

FAQ

Is rebrowser-patches still maintained?

The patched packages were last published in May 2025, based on Puppeteer 24.8.1 and Playwright 1.52.0. Check the repository for current status before relying on it with newer library versions.

What is the Runtime.enable leak?

Puppeteer and Playwright enable the CDP Runtime domain to track execution contexts. While it's on, the browser serializes console arguments in a way page JavaScript can observe, which reveals an automation client. rebrowser-patches and Patchright avoid enabling it in the driver; Clearcote neutralizes it in the engine.

rebrowser-patches vs Clearcote?

rebrowser-patches changes how the automation library talks to a stock Chrome. Clearcote changes the browser, so both the CDP side effects and the fingerprint are handled, with official Puppeteer and Playwright on top.

Related reading

Q&AWhat is CDP detection?The Chrome DevTools Protocol drives automation but leaves side-effects — Runtime.enable, injected init scripts, main-world execution — that a page can observe. Spotting those is CDP detection.CompareClearcote vs PatchrightPatchright is the best-maintained patched Playwright around: a drop-in replacement that removes the driver's automation leaks. It does not change the browser itself, so the fingerprint a site reads is still your machine's. Clearcote works one layer down, in the engine, and the two combine.ResearchHow automation gets caught, layer by layerFrom the WebDriver flag to the TLS handshake — the distinct layers a detector reads, and why fixing one rarely helps.CompareClearcote vs CamoufoxCamoufox is a well-built open-source anti-detect browser, on Firefox. Clearcote takes the same engine-level approach to Chromium, so your automation presents the browser about 69% of the web actually uses instead of one used by about 3%.CompareClearcote vs CloakBrowserCloakBrowser is a capable engine-level stealth Chromium with a large following, but the patched binary is closed source. Clearcote is engine-level too, runs a newer Chromium, and ships an open build whose every patch you can read and rebuild.CompareClearcote vs undetected-chromedriverundetected-chromedriver is still downloaded about 2 million times a month, but its last release was in February 2024. It hides the Selenium/ChromeDriver seam on a stock Chrome and never touches the fingerprint or the network layer. Clearcote changes both in the engine.

Try the open-source Chromium alternative

Free and open source, a drop-in for Playwright & Puppeteer, coherent down to the TLS handshake.

Get it freeSee pricing

Free for one browser with GitHub. No card.