Chrome 148 browser fingerprinting has introduced a subtle new vector: the way your browser computes basic math. Since Chrome 148, V8 delegates Math.tanh and CSS trigonometric functions to the host operating system's math library, which returns slightly different floating-point results on Windows, macOS, and Linux. Anti-bot systems are already reading those bits to detect mismatches between a browser's declared User-Agent and its actual OS.

This article examines how this Chrome 148 browser fingerprinting technique works, which browser surfaces are affected, and what it means for privacy and anti-detection.

Background: The Quiet Signal in Floating-Point Math

IEEE 754 specifies how a floating-point number is stored, but it does not require transcendental functions like tanh, sin, or cos to be correctly rounded. Correct rounding is computationally expensive, so every vendor ships a math library that trades a fraction of a Unit in the Last Place (ULP) for speed. Each implementation uses its own minimax polynomial coefficients, lookup tables, and reduction constants.

The result is that the same function, computed with the same input, can return a different bit pattern on glibc (Linux), libsystem_m (macOS), and UCRT (Windows). They agree on roughly three out of four inputs, meaning the remaining quarter acts as an OS signature.

How Chrome 148 Introduced the Leak

Before Chrome 148, V8 computed Math.tanh internally using a bundled port of fdlibm (Sun's Freely Distributable libm). Every browser returned identical bits regardless of the underlying OS. A V8 commit changed this behavior by routing Math.tanh through the host platform's math library. The change first shipped in V8 14.8.57, which corresponds to Chrome 148.

Now, calling Math.tanh(0.5) on genuine Chrome produces different results depending on the OS:

| OS | Math Library | Math.tanh(0.5) output | | Linux | glibc | 0.6640367702678491 | | macOS | libsystem_m | 0.664036770267849 | | Windows | UCRT | 0.6640367702678489 |

A detector does not need to understand floating-point arithmetic. It only needs a lookup table. Claim macOS but return Linux math bits, and you have contradicted your own User-Agent.

Leak Scope: JavaScript, CSS, and Web Audio

The fingerprinting surface is broader than a single JavaScript function. Three separate browser engines route math through the host library at different call sites.

JavaScript (V8). Only Math.tanh leaks. V8 statically links llvm-libc for all other math functions like Math.sin and Math.cos, so they return identical bits on every OS. The asymmetry is itself detectable: a spoofed browser that changes every function would be inconsistent with how real Chrome behaves.

CSS (Blink). All seven CSS trigonometric functions (sin(), cos(), tan(), asin(), acos(), atan(), atan2()) leak. Blink's layout engine calls the host math library directly for every CSS trig function after performing a degree-to-radian reduction. CSS math and JavaScript math are entirely separate code paths, so patching only the JS side leaves the CSS side exposed.

Web Audio. The DynamicsCompressor node's per-sample transcendental calls use scalar libm on macOS. The Web Audio FFT runs on Apple's Accelerate framework (vDSP), which is a separate code path with its own rounding behavior. Across a million inputs, scalar and Accelerate diverge on 10 to 89 percent of values depending on the function.

Why This Matters for Privacy

This fingerprinting technique is particularly effective because math is deterministic, cheap to probe, and almost never on a spoofing stack's radar. Traditional fingerprinting defenses randomize canvas output or add noise to WebGL rendering, but perturbing math results creates its own detectable signal. A value that matches no real OS or varies between calls is itself a fingerprinting flag.

For users running browsers that advertise privacy protection, this vector is invisible. Chrome 147 and earlier are not affected, but Chrome 148, 149, and 150 all leak. Firefox and Safari have not adopted this change, which means they do not exhibit the same tell.

The Challenge of Spoofing

Reproducing another OS's math output bit-for-bit is difficult for four reasons.

Asymmetric leak. V8 bundles its own math for most functions but delegates Math.tanh to the host library. A spoof that replaces every function creates a detectable inconsistency.

JavaScript and CSS use different paths. The layout engine reduces angles in degrees before calling the host cos/tan, producing different results than a direct radian call from JavaScript. Both paths must be matched independently.

macOS has two math libraries. Apple Silicon carries scalar libm and the Accelerate framework's vector routines. They disagree on the same input. Scalar libm backs CSS trig and the audio compressor's per-sample calls, while Accelerate backs the Web Audio FFT and vector stages. Picking the wrong library for a call site lands 1 ULP off on most inputs.

Architecture differences. ARM and x86 differ on fused-multiply-add behavior and NaN sign propagation. A reproduction that is correct on paper can drift when the compiler fuses a multiply-add on one target and not the other.

Frequently Asked Questions

Does this affect Firefox or Safari? No. Firefox and Safari have not adopted this V8 change. The fingerprinting vector is currently specific to Chrome 148 and later.

Is Math.tanh the only function that leaks in JavaScript? Yes. V8 statically links its other math functions through llvm-libc, which is identical on every OS. CSS trigonometric functions also leak because Blink calls the host library directly.

Can this be used to identify individual users? This technique identifies the operating system, not the individual user. Combined with other fingerprinting signals (screen resolution, installed fonts, canvas hash), it contributes to a larger device profile.

Does incognito mode prevent this? No. The fingerprinting vector operates at the JavaScript and CSS engine level, which is unaffected by private browsing mode.

Can browser extensions block this? A script-blocking extension that prevents Math.tanh calls could block the probe, but CSS trigonometric functions are evaluated during page layout and are harder to intercept.

Key Takeaways

• Chrome 148 introduced a host-OS math dependency in V8 that leaks the operating system through Math.tanh, CSS trigonometric functions, and Web Audio processing.
• Three separate code paths (JS, CSS, Web Audio) with different math libraries create a complex fingerprinting surface that is difficult to spoof consistently.
• Privacy-focused browser users on Chrome 148+ are exposed regardless of incognito mode.
• The technique is already being used by anti-bot systems to detect mismatches between declared User-Agent and actual OS math bits.
• The only complete mitigation today is using a browser that does not delegate transcendental math to the host OS.

Conclusion

The discovery that Math.tanh returns different bit patterns per operating system represents a meaningful evolution in browser fingerprinting. Unlike traditional fingerprint vectors that can be randomized, math determinism makes this signal both reliable and hard to fake. For developers building privacy-respecting applications, awareness of this vector is the first step. For now, the only complete mitigation is using a browser that does not delegate transcendental math to the host operating system.

---

Sources

• Scrapfly Engineering Blog: Your Browser Does Math Differently on Every OS, and Anti-Bot Systems Read the Bits
• V8 source: liangi/pkg/pseries.tcc - host libm call for Math.tanh
• IEEE 754 Standard for Floating-Point Arithmetic
• LLVM libc Project