<story><title>New headless Chrome has been released and has a near-perfect browser fingerprint</title><url>https://antoinevastel.com/bot%20detection/2023/02/19/new-headless-chrome.html</url></story><parent_chain></parent_chain><comment><author>natorion</author><text>I am the PM working on Headless. Feel free to ask questions in this thread and I will try to answer them if I can.&lt;p&gt;Edit: Please also note that we have not released New Headless yet. We &amp;quot;merely&amp;quot; landed the source code.</text></comment>
<story><title>New headless Chrome has been released and has a near-perfect browser fingerprint</title><url>https://antoinevastel.com/bot%20detection/2023/02/19/new-headless-chrome.html</url></story><parent_chain></parent_chain><comment><author>graderjs</author><text>I built a remote browser based on headless Chrome^0 and this is going to make things way easier. It&amp;#x27;s also great to see Google supporting Chrome use cases beyond &amp;quot;consumer browsing&amp;quot;, and perhaps that&amp;#x27;s in large part been pushed by the &amp;quot;grass roots popularity&amp;quot; of things like puppeteer and playwright.&lt;p&gt;One thing I&amp;#x27;m hoping for (but have heard it would require &lt;i&gt;extensive&lt;/i&gt; rejigging of almost absolutely everything) is Extensions support in this new headless.&lt;p&gt;However, if I&amp;#x27;m reading the winds, it seems as if things &lt;i&gt;might&lt;/i&gt; be going there, because:&lt;p&gt;- Tamper scripts now work on Firefox mobile&lt;p&gt;- Non-webkit iOS browsers are in the works&lt;p&gt;- It&amp;#x27;s technically possible to &amp;quot;shim&amp;quot; much of the chrome.extension APIs using RDP (the low-level protocol that pptr and its ilk are based on) which would lead essentially to a &amp;quot;parallel extensions runtime&amp;quot; and &amp;quot;alt-Webstore&amp;quot; with less restrictions, something which Google may not look merrily upon&lt;p&gt;Anyway, back to &amp;quot;headless detection&amp;quot;, for the remote isolated browser, I have been  using an extensive bot detection evasion script that proxied many of the normal properties on navigator (like plugins, etc), and tested extensively against detectors like luca.gg&amp;#x2F;headless^1&lt;p&gt;Interestingly one of the most effective way to defeat &amp;quot;first wave&amp;quot; &amp;#x2F; non-sophisticated bots used to be simply throwing up a JS modal (alert, confirm, prompt) -- for the convenient way it kills the JS runtime until dismissed, and how you have to explicitly dismiss it.&lt;p&gt;^0 = &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;crisdosyago&amp;#x2F;BrowserBox&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;crisdosyago&amp;#x2F;BrowserBox&lt;/a&gt;&lt;p&gt;^1 = &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;luca.gg&amp;#x2F;headless&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;luca.gg&amp;#x2F;headless&amp;#x2F;&lt;/a&gt;</text></comment>