What is DOMRect fingerprinting?

DOMRect fingerprinting reads the geometry a browser reports for laid-out elements — the x, y, width and height of the DOMRect objects returned by element.getBoundingClientRect() and Range.getClientRects() — and hashes it. Canvas text measurement is the close cousin: CanvasRenderingContext2D.measureText() hands back a TextMetrics object rather than a rect, but its width comes out of the same text-shaping path. The numbers are floats, not integers: a run of text laid out at a given font size resolves to a sub-pixel advance width that depends on which font file was actually selected, how the shaping engine applied kerning and hinting, and how the platform rasterizer quantises the result. Measure a fixed string in a fixed font and the fractional part of the answer is a device-and-build-specific value that needs no pixel readback and no permission to collect.

The entropy comes from the same substrate as font fingerprinting and canvas fingerprinting, but through a cheaper channel. Canvas needs to draw and read back pixels; DOMRect only needs layout to happen, which it does anyway. Font enumeration needs a candidate list; a rect measurement of a single string already encodes which face the fallback chain resolved to. That makes rect geometry a routine part of a fingerprint rather than an exotic probe.

What turns geometry into a coherence signal is that the same text can be measured through two independent code paths that must agree. The Clearcote audit's bcr-vs-range check lays out an absolutely-positioned <div> containing WWWWWiiiii at 16px Arial, then reads getBoundingClientRect().left on the element and getClientRects()[0].left on a Range selecting the same node contents. Both read out of one layout tree, so an unmodified browser returns the identical number — the check passes only when the two lefts agree within 1e-6 and both sit on the grid. A hook that fuzzes getBoundingClientRect — a common way to blunt this vector — rarely also covers Range client rects, and the two readings of one element then contradict each other. No real rendering produces that disagreement.

The second half of the check is the shape of the number, not its value. Chromium computes text advances in fixed point, so 2D text metrics land on a dyadic 1/512-pixel grid. The audit's measuretext-grid check measures five strings at 12px Arial and asserts that width * 512 is an integer within a 1e-6 tolerance; bcr-vs-range applies the same grid test to both lefts. Multiplying a width by a farble scale factor yields a number that still looks like a plausible float but no longer sits on the grid — so post-processing is visible from the returned value alone, with no reference corpus and no baseline to compare against. A detector needs one line of arithmetic.

The same logic extends across realms: text shaping runs the same engine code on the main thread and inside a Worker, so a real browser returns bit-identical widths in both scopes. The audit's worker-vs-main check measures those same five strings on a page canvas and again on an OffscreenCanvas in a dedicated Worker, and requires the two sets to match to within 1e-9. A modification applied only to the document's canvas prototype never reaches the Worker, and the divergence indicates scope-limited patching rather than any particular hardware — see why a worker must report the same values as the page.

One caveat matters for interpretation. Several privacy-focused browsers deliberately perturb rect and text-metric output as a stock anti-tracking feature. An off-grid or self-contradicting rect therefore means randomisation is present — it does not mean automation, and it should be reported as a randomisation finding attributable to a privacy defence, not as a bot. If element geometry must vary, the variation has to happen inside layout itself so every rect API reads from the same tree and results stay quantised; a multiplicative scale applied on the way out of JavaScript fails both tests at once. That distinction — deviation from spec versus mere uniqueness — is the subject of coherence over camouflage.