Chromium 148: Math.tanh Becomes a New Tool for OS Fingerprinting

Researchers have discovered that, starting with version 148 of Chromium, JavaScript's built-in Math.tanh function produces slightly different numerical results depending on the operating system the browser is running on.

This discrepancy arises from differences in how mathematical computations are implemented at the level of the system libraries and the compiler used to build Chromium for the various platforms. As a result, the same code computing Math.tanh for identical input values can return different values in the low-order bits of a floating-point number's mantissa on Windows, macOS and Linux.

This quirk makes Math.tanh suitable for fingerprinting — determining a site visitor's operating system without using traditional methods such as the User-Agent header or the navigator.platform API. Because the value is returned by an ordinary mathematical function rather than through an explicitly identifying interface, such an approach is harder to detect and block with standard anti-tracking defenses.

The publication sparked a wide-ranging discussion on Hacker News, where the piece drew 220 votes and 109 comments. Users note that side effects like this in the implementation of basic browser functions regularly become the source of new fingerprinting techniques, since browser developers rarely consider mathematical functions a potential channel for information leakage.

The case illustrates a general problem with modern browser engines: even standardized, seemingly deterministic operations can contain platform-dependent quirks if their implementation relies on system libraries. This creates additional challenges for developers of privacy-protection tools, who must account for an ever-widening range of potential sources of user identification.

Details of the mechanism and code examples are provided in the original publication.

Source: Hacker News