Chrome for Testing vs Google Chrome: what a website can tell apart

npx @puppeteer/browsers install chrome@stable        # Chrome for Testing
npx @puppeteer/browsers install chrome-headless-shell@stable
# or directly:
curl -sSO https://storage.googleapis.com/chrome-for-testing-public/154.0.8037.57/linux64/chrome-linux64.zip

./chrome-linux64/chrome --disable-field-trial-config --disable-infobars --user-data-dir="$(mktemp -d)"

// Chrome for Testing vs Google Chrome: paste into the DevTools console on any https:// page and press Enter.
// Each line prints the row and the value this browser returns. Expected values: clearcotelabs.com/chrome-for-testing
(async () => {
  const checks = [
    ["cft-navigator-languages", () => navigator.languages],
    ["cft-xml-parser-rust", () => new DOMParser().parseFromString('<a><b></a>', 'application/xml').querySelector('parsererror div').textContent.trim()],
    ["cft-xslt-disabled", () => typeof XSLTProcessor],
    ["cft-webmcp", () => typeof ModelContext],
    ["cft-webmcp", () => 'modelContext' in document],
    ["cft-webmcp", () => 'agentInvoked' in SubmitEvent.prototype],
    ["cft-webmcp", () => document.featurePolicy.features().includes('tools')],
    ["cft-topics-disabled", () => 'browsingTopics' in document],
    ["cft-topics-disabled", () => document.featurePolicy.features().includes('browsing-topics')],
    ["cft-protected-audience-disabled", () => 'runAdAuction' in navigator],
    ["cft-protected-audience-disabled", () => 'joinAdInterestGroup' in navigator],
    ["cft-attribution-reporting-disabled", () => 'attributionSrc' in HTMLAnchorElement.prototype],
    ["cft-attribution-reporting-disabled", () => 'setAttributionReporting' in XMLHttpRequest.prototype],
    ["cft-unload-allowlist", () => document.featurePolicy.allowedFeatures().includes('unload')],
    ["cft-brand-list", () => navigator.userAgentData.brands.map((b) => `${b.brand};v=${b.version}`).join(', ')],
    ["cft-for-testing-infobar", () => outerHeight - innerHeight],
    ["cft-google-voices", () => new Promise((r) => { speechSynthesis.getVoices(); setTimeout(() => r(speechSynthesis.getVoices().filter((v) => v.name.startsWith('Google')).length), 1000); })],
    ["hs-user-agent-full-version", () => /Chrome\/\d+\.0\.0\.0 /.test(navigator.userAgent)],
    ["hs-user-agent-full-version", () => navigator.userAgent.split(' ').find((t) => t.includes('Chrome/'))],
    ["hs-no-window-chrome", () => typeof window.chrome],
    ["hs-no-pdf-viewer", () => navigator.pdfViewerEnabled],
    ["hs-no-pdf-viewer", () => navigator.plugins.length],
    ["hs-no-pdf-viewer", () => navigator.mimeTypes.length],
    ["hs-permission-defaults", () => navigator.permissions.query({ name: 'clipboard-write' }).then((s) => s.state)],
    ["hs-permission-defaults", () => navigator.permissions.query({ name: 'background-sync' }).then((s) => s.state)],
    ["hs-permission-defaults", () => navigator.permissions.query({ name: 'periodic-background-sync' }).then((s) => s.state)],
    ["hs-window-geometry", () => `${outerWidth}x${outerHeight} ${innerWidth}x${innerHeight} @${screenX},${screenY}`],
    ["hs-no-hreftranslate", () => 'hrefTranslate' in HTMLAnchorElement.prototype],
    ["hs-webview-element", () => document.createElement('webview') instanceof HTMLUnknownElement],
    ["hs-no-widevine", () => navigator.requestMediaKeySystemAccess('com.widevine.alpha', [{ initDataTypes: ['cenc'], videoCapabilities: [{ contentType: 'video/mp4; codecs="avc1.42E01E"' }] }]).then(() => 'supported', (e) => e.name)],
    ["hs-network-quality", () => navigator.connection.rtt],
    ["hs-emoji-metrics", () => document.createElement('canvas').getContext('2d').measureText('🙂').width],
    ["hs-heap-limit", () => performance.memory.jsHeapSizeLimit],
  ];
  const out = [];
  for (const [id, f] of checks) {
    let v;
    try { v = await f(); } catch (e) { v = "throws " + e.name; }
    out.push(id.padEnd(34) + (typeof v === "string" ? JSON.stringify(v) : JSON.stringify(v) ?? String(v)));
  }
  console.log(out.join("\n"));
})();

// Chrome for Testing vs Google Chrome, network side: open https://tls.peet.ws/api/all in a fresh tab, then paste this into its console.
// The page shows what the server received; these lines read the fingerprints out of it.
(async () => {
  const checks = [
    ["cft-tls-server-padding", () => JSON.parse(document.querySelector('pre').textContent).tls.ja4],
    ["cft-tls-server-padding", () => JSON.parse(document.querySelector('pre').textContent).tls.extensions.some((e) => e.name === 'Unknown extension 4832')],
    ["cft-accept-language-early", () => ((h) => h[h.findIndex((x) => x.startsWith('accept-language:')) - 1].split(':')[0])(JSON.parse(document.querySelector('pre').textContent).http2.sent_frames.find((f) => f.frame_type === 'HEADERS').headers)],
    ["hs-no-accept-language", () => JSON.parse(document.querySelector('pre').textContent).http2.sent_frames.find((f) => f.frame_type === 'HEADERS').headers.some((h) => h.startsWith('accept-language:'))],
    ["hs-tls-no-trust-anchors", () => JSON.parse(document.querySelector('pre').textContent).tls.extensions.some((e) => e.name === 'Unknown extension 51764')],
  ];
  const out = [];
  for (const [id, f] of checks) {
    let v;
    try { v = await f(); } catch (e) { v = "throws " + e.name; }
    out.push(id.padEnd(34) + (typeof v === "string" ? JSON.stringify(v) : JSON.stringify(v) ?? String(v)));
  }
  console.log(out.join("\n"));
})();