Skip to content
All fingerprint checks
Render & GPU

a WebGL2 framebuffer reads back the same through readPixels and a pixel pack buffer

Pim· Clearcote Research 2 min readCheck id webgl2-pbo-readback-vs-readpixels

Every channel agrees between readPixels and the same framebuffer read through a pixel pack buffer. N/A without WebGL2 or when the readback cannot complete (severity: warn).

What a detector infers

WebGL2 has two ways to read a framebuffer: readPixels into an array hands the pixels straight to script, and readPixels into a PIXEL_PACK_BUFFER followed by getBufferSubData copies them through a GPU-side buffer. Both read one framebuffer at one moment, so a genuine browser returns identical bytes — measured 0 differing channels of 4096 on Chrome 153, Edge 153, Chromium 143 and Firefox 144.

The buffer route is a separate code path, and it is the one a readback perturbation tends to miss. When it does, the page is handed two different images of one framebuffer, and the unperturbed one is the real GPU output. Measured on a patched Chromium 153 with a fingerprint seed: 13 channels differ, and the pack-buffer bytes hash identically to genuine Chrome on the same GPU.

Same family as canvas-toblob-vs-todataurl and webgl-readpixels-vs-todataurl: an exit the perturbation never reaches.

How to resolve it

Apply any readback perturbation once, at the point every exit reads from, or not at all. Covering readPixels into an array but not readPixels into a pack buffer both leaks the true pixels and proves the other path was altered.

Coherence over camouflage: why a plausible identity beats a hidden one

Nearby checks in Render & GPU

See all 49 checks in Render & GPU
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Render & GPU checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Render & GPU — the family webgl2-pbo-readback-vs-readpixels belongs to.