WebGL Fingerprinting: How Your GPU Identity Is Exposed

Introduction

WebGL provides a direct window into your GPU hardware. Through the WEBGL_debug_renderer_info extension, any website can read your exact GPU model and driver vendor. Combined with WebGL parameter queries and rendering output, this creates a highly unique fingerprint that is difficult to spoof without engine-level control.

What WebGL Reveals

GPU Identity

The WEBGL_debug_renderer_info extension exposes two critical strings:

const gl = canvas.getContext('webgl');
const ext = gl.getExtension('WEBGL_debug_renderer_info');
const vendor = gl.getParameter(ext.UNMASKED_VENDOR_WEBGL);
const renderer = gl.getParameter(ext.UNMASKED_RENDERER_WEBGL);
// Example: "Google Inc. (NVIDIA)", "ANGLE (NVIDIA, NVIDIA GeForce RTX 3080, OpenGL 4.5)"

Parameter Queries

WebGL exposes dozens of capability parameters that vary by GPU:

• MAX_TEXTURE_SIZE - Maximum texture dimension
• MAX_VIEWPORT_DIMS - Maximum viewport size
• MAX_RENDERBUFFER_SIZE - Maximum renderbuffer dimension
• Shader precision values (vertex and fragment shaders)
• Supported extensions list

Rendering Output

Like canvas, WebGL rendering produces GPU-specific output. Shader programs execute with hardware-dependent floating-point precision, producing subtle differences in rendered images.

Why This Matters for Automation

WebGL fingerprinting is particularly problematic for automation because:

1. Headless browsers often lack GPU access, falling back to software rendering with completely different renderer strings (e.g., "SwiftShader" instead of a real GPU)
2. Virtual machines expose their virtualized GPU, which is a strong signal of non-human usage
3. All sessions on the same machine share the same GPU identity, making them trivially linkable

How BotCloud Manages GPU Identity

Each BotCloud session receives a profile with complete GPU identity:

• Renderer and vendor strings match real-world GPU configurations
• WebGL parameters are consistent with the claimed GPU model
• Shader precision values align with the GPU's actual capabilities
• Extension lists match what the claimed GPU supports
• Rendering output uses profile-controlled noise for consistency

The profile ensures that all WebGL signals are internally consistent. A profile claiming an NVIDIA RTX 3080 will report the correct max texture sizes, shader precision, and extension support for that GPU.

WebGL2 and WebGPU

WebGL2 adds additional parameters and capabilities that contribute to fingerprinting entropy. BotCloud profiles cover WebGL2 parameters with the same consistency guarantees.

WebGPU, the next-generation graphics API, exposes adapter information through requestAdapterInfo(). BotCloud profiles include WebGPU identity that aligns with the WebGL profile, preventing cross-API inconsistencies.

Best Practices

1. Always use profiles with realistic GPU data rather than blocking WebGL entirely
2. Ensure WebGL and Canvas fingerprints are consistent - they should reflect the same GPU
3. Verify headless sessions produce real GPU strings, not software renderer identifiers
4. Check that WebGL2 parameters align with WebGL1 on the same profile