Starting with Chromium version 148, the JavaScript Math.tanh function returns values that differ slightly depending on the underlying operating system. These differences arise from variations in how each OS handles floating-point arithmetic at the hardware level. Researchers at Scrapfly demonstrated that this creates a new fingerprinting vector, allowing websites to infer whether a user is on Windows, macOS, or Linux with high accuracy. The technique works silently in the background without any user permission or notification.
This discovery is a reminder that our browsers are constantly leaking information. Every new feature, every optimization, can become a surveillance tool. The Chromium team didn't intend to create a fingerprinting vector. They just wanted faster math. But that's exactly what happened.
The good news? This particular vector is relatively easy to fix. Browser vendors can standardize floating-point behavior or add noise to mathematical functions. But the deeper problem remains. Our digital identities are built from thousands of tiny signals. Each one seems harmless alone. Together, they paint a complete picture. We need systemic privacy protections, not just patches for individual leaks.