Skip to content
All fingerprint checks
Render & GPU

WebGL state reads back what the page just set

Pim· Clearcote Research 2 min readCheck id webgl-state-reads-back

STENCIL_WRITEMASK, STENCIL_VALUE_MASK and COLOR_CLEAR_VALUE read back 15, 51 and [0.25, 0.5, 0.75, 1] after the page sets them (severity: warn).

What a detector infers

Some WebGL parameters are not capabilities but state the page itself controls. After stencilMask(0x0f), STENCIL_WRITEMASK must read 15; after stencilFunc(ALWAYS, 0, 0x33), STENCIL_VALUE_MASK must read 51; after clearColor(0.25, 0.5, 0.75, 1), COLOR_CLEAR_VALUE must read exactly that back. The specification defines these as the values last set, so the right answer is known before asking, with no reference data at all.

A getParameter hook that answers from a captured table of another machine's parameters has no notion of state: it returns whatever the table holds — typically the defaults the capture was taken with, stencil masks of 4294967295 and a clear colour of 0, 0, 0, 0 — whatever the page has just done. Measured on every stock browser tested: 15, 51 and 0.25, 0.5, 0.75, 1. The failing side was a table-replay spoof written for this test rather than a captured tool.

No ordinary configuration is known to break it; it is state the page sets and reads back in the same breath.

How to resolve it

Leave getParameter to the implementation. A table can describe limits, but not state the page has just changed; any wrapper has to pass state queries through to the real context.

What is WebGL fingerprinting?

Nearby checks in Render & GPU

See all 64 checks in Render & GPU
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Render & GPU checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Render & GPU — the family webgl-state-reads-back belongs to.