Skip to content
All fingerprint checksRender & GPU

every extension WebGL advertises can actually be instantiated

Check id webgl-extensions-vs-driver

What an ordinary browser yields

Every name in getSupportedExtensions() returns a non-null object from getExtension — the list and the driver agree because they are the same driver.

What a detector infers

getSupportedExtensions() returns a list a page can rewrite; getExtension(name) either hands back a real extension object or null, and that answer is the driver. So the list is a claim and each getExtension is the driver honouring or refusing it. A context that advertises an extension it cannot instantiate is contradicting its own capability report — the shape a spoof produces when it pads the extension list to resemble a target GPU without the backend to support it. Direction is chosen carefully: a short list is fine, because privacy builds legitimately trim it and Brave in its strict mode returns few or none, and a lost or absent context is quiet. The invariant fires only on an advertised-but-unbacked entry, which no honest driver produces. Like the GL-limits check, it needs no table of real extensions per GPU — it only asks whether the context can do the thing it just said it could.

How to resolve it

getSupportedExtensions and getExtension read one driver and cannot disagree in a real browser. Padding the list to look like another GPU leaves getExtension returning null for the entries the backend lacks. Present a GPU whose real driver supports what you advertise.

What is WebGL fingerprinting?

Read in the wild by

CloakBrowser issues

The tracker records spoofed WebGL surfaces where the advertised capability set does not match the driver actually present under docker/xvfb.

CloakHQ/CloakBrowser #333, #345, #92 (WebGL driver/extension leaks)

CloakHQ/CloakBrowser#333

Every attribution traces to a published artifact. See the sources and their limits.

Nearby checks in Render & GPU

See all 32 checks in Render & GPU
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Render & GPU checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Render & GPU — the family webgl-extensions-vs-driver belongs to.