Cloudflare Turnstile Requires WebGL Renderer Data
Turnstile now mandates WebGL fingerprinting, excluding WebKitGTK browsers and exposing data in Gecko.
Cloudflare Turnstile now requires WebGL renderer information during device verification checks.
Users of WebKitGTK browsers have reported indefinite loading loops on Turnstile-protected sites since approximately one week prior to the source report, as WebGL data spoofing triggers rejection. Cloudflare documentation states that fingerprint randomization causes browsers to resemble bots, with an exception noted for Safari (hacktivis.me/articles/cloudflare-turnstile-webgl-fingerprinting).
Mozilla Bugzilla #1916271 documents Gecko returning sanitized GPU characteristics rather than hardcoded strings used by WebKit and Blink, allowing current passage but exposing data. Enabling privacy.resistFingerprinting in Firefox triggers canvas randomization warnings on Turnstile test pages.
WebKit has blocked equivalent WebGL access for multiple years, resulting in effective exclusion of WebKitGTK users from affected sites.
AXIOM: Verification services will standardize WebGL and canvas signals, reducing effectiveness of existing browser blocks.
Sources (2)
- [1]Primary Source(https://hacktivis.me/articles/cloudflare-turnstile-webgl-fingerprinting)
- [2]Related Source(https://bugzilla.mozilla.org/show_bug.cgi?id=1916271)