M3 Mac v148 Fails Browser Tampering Check on Fingerprint https://demo.fingerprint.com/playground

[mattyTokenomics]

Description:
Fingerprint Pro Playground still reports Browser Tampering on macOS v148 Pro.

Expected: Fingerprint Pro Playground should come back clean on the latest macOS v148 build, consistent with the note in #271 that v148 resolves the prior macOS FPJS issue.

Actual:
- Bot: Not detected
- VPN: Not detected
- Developer Tools: Not detected
- Virtual Machine: Not detected
- Privacy Settings: Not detected
- Browser Tampering: Yes
- Browser classified as: Chromium-Based Browser
- Browser major/full version: Not Available
- Server fields:
  - tampering: true
  - tampering_ml_score: 0.9947
  - anti_detect_browser: true
  - suspect_score: 14

CloakBrowser version:
npm: cloakbrowser@0.4.3
Binary: 148.0.7778.215.2 Pro
Platform: darwin-arm64

Wrapper:
JavaScript

Environment:
macOS host, no Docker
Apple Silicon / darwin-arm64
Machine: Apple M3 Max
Node.js project using cloakbrowser npm package
Running headed, persistent context

Launch options:

```js
await launchPersistentContext({
  userDataDir: "./profile",
  headless: false,
  humanize: false,
  locale: "en-US",
  timezone: "America/New_York",
  colorScheme: "light",
  args: [
    "--fingerprint=21720260625",
    "--fingerprint-platform=macos",
    "--fingerprint-noise=false",
    "--fingerprint-screen-width=1440",
    "--fingerprint-screen-height=900",
    "--fingerprint-brand=Chrome",
    "--fingerprint-brand-version=148.0.7778.215",
    "--fingerprint-storage-quota=5000",
    "--fingerprint-taskbar-height=95"
  ]
});

Tested with a different IP or proxy?
No. Same residential ISP IP as other browser controls. FP.com reports VPN/proxy not detected.

Works outside Docker / on host machine?
Not using Docker. This is native macOS host.

Steps to reproduce:

1. Install/use cloakbrowser@0.4.3 with Pro license.
2. Confirm binary is darwin-arm64 v148.0.7778.215.2 Pro.
3. Launch headed persistent context with the options above.
4. Navigate to https://demo.fingerprint.com/playground
5. Wait for the playground to finish analysis.
6. Observe Browser Tampering and server JSON fields.

Error output / screenshots:
Attached screenshot shows:

• Bot: Not detected
• VPN: Not detected
• Browser Tampering: Yes
• Suspect Score: 14

Server JSON fields captured:

{
  "browser_name": "Chromium-Based Browser",
  "browser_major_version": "Not Available",
  "browser_full_version": "Not Available",
  "bot": "not_detected",
  "tampering": true,
  "tampering_ml_score": 0.9947,
  "anti_detect_browser": true,
  "suspect_score": 14
}

Dockerfile (if applicable):
N/A

Additional notes:
I also tested several related variants and the Browser Tampering / anti_detect_browser result persisted:

• --fingerprint-noise=false only
• explicit screen width/height
• full macOS flag set
• low storage quota: --fingerprint-storage-quota=500
• high storage quota: --fingerprint-storage-quota=50000
• local Widevine CDM sideloaded from Brave; EME probe confirmed com.widevine.alpha supported
• regular launch() instead of launchPersistentContext()
• Windows persona flags:
  • --fingerprint-platform=windows
  • --fingerprint-screen-width=1920
  • --fingerprint-screen-height=1080
  • --fingerprint-windows-font-metrics

The consistent clue is that FP.com reports Cloak as Chromium-Based Browser with version Not Available, while Brave on the same machine/IP is classified cleanly.

[Cloak-HQ]

Thanks for the detailed report (M3 Max, darwin-arm64, v148 Pro, persistent context).

We reproduced the browser-tampering on our side on the latest macOS Apple Silicon build, so this is a confirmed regression and we're on it.

We're tracking down the root cause now. One factor we're verifying: FingerprintJS recently rolled their agent to 4.1.1, so we want to confirm how much of this is that update versus our build. For context, our latest Linux v148 build is currently passing the same browser-tampering check, which points us toward something macOS specific.

We'll update this issue as we make progress.

CloakHQ

[Cloak-HQ]

Thanks for the detailed report, and for your patience on this one.

This was a tricky one. We ruled out a lot of surfaces before tracing it to a small coherence gap specific to our macOS Apple Silicon build, where one part of how the build represented itself looked inconsistent to FingerprintJS's tampering model. Every other signal was already clean.

Candidly, our macOS build has trailed Linux and Windows for the last couple of major versions, and this is where that gap showed up. The deep dive gave us a full map of the macOS signals, so we can keep it at parity going forward.

We have a fix, verified end to end on the same build (FingerprintJS playground), both regular and persistent context:

• tampering: false (was true)
• tampering_ml_score: ~0.003–0.009 (was 0.9947), in line with stock Chrome
• anti_detect_browser: false (was true)
• Browser identified as Chrome 148.0.0 (was "Chromium-Based Browser / Not Available")
• bot, VPN, virtual machine, developer tools, privacy settings: all clean

With the fixed build the only flag you should need is --fingerprint-noise=false. You can drop the rest (platform, screen size, brand, storage-quota, taskbar-height).

We are packaging this into the next macOS build and will release it soon. We will update this issue the moment it is live.

CloakHQ

[Cloak-HQ]

Thanks for the detailed report and for waiting while we finished the macOS build.

The fixed macOS Apple Silicon Pro binary is now live as 148.0.7778.215.3.

We re-tested it on a real Apple Silicon Mac against Fingerprint Pro Playground, using a residential proxy with geoip: true, in both regular launch and persistent context. Persistent context does not need a Widevine sideload on macOS.

Results on darwin-arm64:

Mode	bot	incognito	browser tampering	anti_detect_browser	tampering_ml_score	virtual machine	VPN
regular launch()	not_detected	true	false	false	~0.026	false	false
launchPersistentContext()	not_detected	false	false	false	~0.027	false	false

Regular launch:

import { launch } from "cloakbrowser";

const browser = await launch({
  headless: false,
  proxy: "http://user:pass@residential-proxy:port",
  geoip: true,
  args: ["--fingerprint-noise=false"],
});

const page = await browser.newPage();
await page.goto("https://demo.fingerprint.com/playground");

Persistent context:

import { launchPersistentContext } from "cloakbrowser";

const context = await launchPersistentContext({
  userDataDir: "./profile",
  headless: false,
  proxy: "http://user:pass@residential-proxy:port",
  geoip: true,
  args: ["--fingerprint-noise=false"],
});

const page = context.pages()[0] ?? await context.newPage();
await page.goto("https://demo.fingerprint.com/playground");

You can drop the explicit platform, brand/version, screen-size, storage-quota, and taskbar-height flags for native macOS.

To update, upgrade the wrapper and let it fetch the latest Pro binary, or pin explicitly to 148.0.7778.215.3 if needed.

Let us know if this works for you on the M3 Max as well.

CloakHQ