Cosmium – Undetectable Browser Automation at Scale
Challenge
Off-the-shelf stealth tooling (patchright, undetected-chromedriver) can hide automation APIs like navigator.webdriver, but cannot fix the hardware-absence tells that betray a containerized browser: SwiftShader WebGL strings, empty media devices, Linux Client Hints leaking under a Windows user agent, Docker bridge IPs in WebRTC candidates, UTC timezones, missing fonts.
Solution
Forked Chromium and wrote a surgical C++ patch series exposing a command-line switch for every spoofable surface, orchestrated by a Rust workspace that loads JSON fingerprint profiles, validates their coherence, and launches the patched binary. Added an LLM-assisted authoring loop that generates and repairs coherent fingerprint profiles from a persona description, plus reproducible Docker images for the full Chromium build.
Technologies
Key Results
- A Chromium binary that does not fingerprint as a container
- Every spoofable surface controlled via dedicated --cosmium-* switches
- Coherent fingerprint profiles generated and validated automatically
- Fully reproducible build and runtime environments in Docker