Hello @shepherd,

can you clarify what exactly do you mean by "Everything comes out the same with or without JShelter enabled (default settings)." and also clarify the how to reproduce section that does not match the expected result. Specifically, your how to reproduce steps does not include enabling or disabling JShelter.

I tried several tests on my own.

First of all, let us try Brave (1.78.94 - Chromium 136) without JShelter:

• Visit https://dev-pages.brave.software/fingerprinting/farbling.html, the table Fingerprint Values is not populated in the last 5 columns.
• Click Generate fingerprints.
• Columns This page, Local Frame, and Remote Frame are fully populated, WebWorker stays empty, ServiceWorker is partially populated.
• I tried several times and once the ServiceWorker column was not populated.
• The values in the columns This page, Local Frame, and Remote Frame are the same for each row except Screen resolution media query that is same for This page and Local Frame but different for Remote Frame.
• In the ServiceWorker column I see the same values in WebGL Vendor and Render, WebGL2 Params, User Agent, Hardware Concurrency, Device Memory, and navigator.languages.
• In the ServiceWorker column I see different values in WebGL Drawing, Canvas, and Accept-Language.
• Other rows for ServiceWorker stay empty.

Now let us try Chromium 136 with JShelter active but disable JS Shield for the test domain:

• Visit https://dev-pages.brave.software/fingerprinting/farbling.html, the table Fingerprint Values is not populated in the last 5 columns.
• Click Generate fingerprints.
• I received notification from JShelter about detected fingerprinting (Very high/6 shown in the popup window/badge). Note that this is different to the reported behaviour by @shepherd .
• Columns This page, Local Frame, and Remote Frame are fully populated, WebWorker stays empty, ServiceWorker is partially populated (the same rows are populated as in Brave).
• The values in the columns This page and Local Frame are the same for each row.
• The value in Remote Frame is different to the value in This page and Local Frame in the rows WebGL Drawing, Canvas (including all channels), Hardware Concurrency, Enumerate Devices, Device Memory, and Speech Voices. This is caused by JShelter running in the context of the remote frame (note that JSS is disabled only for the domain with the test). As JShelter modifies these APIs, they should be different. Note that I see zeroes for Speech Voices, there could be a bug but it does not look like bug in JShelter.
• By clicking on the cell of WebGL Vendor and Render and WebGL2 Params, it looks like the values are not modified in the remote frame. Also Web Audio shows the same hash in all three columns..
• Service Worker has different value for Canvas and Accept-Language.

Let us disable JShelter in chrome://extensions and close the tab with the test. Open new one to be sure that JShelter is gone:

• Visit https://dev-pages.brave.software/fingerprinting/farbling.html, the table Fingerprint Values is not populated in the last 5 columns.
• Click Generate fingerprints.
• Columns This page, Local Frame, and Remote Frame are fully populated, WebWorker stays empty, ServiceWorker is partially populated (the same rows are populated as in Brave).
• All rows contains the same value but Canvas and AcceptLanguage in WebWorker. Also Speech Voices is now all zeroes in all three columns.

Let us reenable JShelter in chrome://extensions and close the tab with the test to be sure that JShelter is later properly loaded:

• Open global JShelter preferences and disable FPD globally.
• Visit https://dev-pages.brave.software/fingerprinting/farbling.html, the table Fingerprint Values is not populated in the last 5 columns.
• Click Generate fingerprints.
• Columns This page, Local Frame, and Remote Frame are fully populated, WebWorker stays empty, ServiceWorker is partially populated (the same rows are populated as in Brave).
• The values in the columns This page and Local Frame are the same for each row.
• The value in Remote Frame is different to the value in This page and Local Frame in the rows WebGL Drawing, Canvas (including all channels), Hardware Concurrency, Enumerate Devices and Device Memory. This is caused by JShelter. As JShelter modifies these APIs, they should be different.
• Note that I see zeroes for Speech Voices in all three columns.
• By clicking on the cell of WebGL Vendor and Render and WebGL2 Params, it looks like the values are not modified in the remote frame and on the local page. Also Web Audio shows the same hash in all three columns..
• Service Worker has different value for Canvas and Accept-Language.

Go back to global JShelter settings and reenable FPD:

• Visit https://dev-pages.brave.software/fingerprinting/farbling.html, the table Fingerprint Values is not populated in the last 5 columns.
• Click Generate fingerprints.
• It takes longer but columns This page, Local Frame, and Remote Frame are fully populated, WebWorker stays empty, ServiceWorker is partially populated (the same rows are populated as in Brave).
• The values in the columns This page and Local Frame are the same for each row.
• The value in Remote Frame is different to the value in This page and Local Frame in the rows WebGL Drawing, Canvas (including all channels), Hardware Concurrency, Enumerate Devices and Device Memory. This is caused by JShelter. As JShelter modifies these APIs, they should be different.
• Note that I see zeroes for Speech Voices in the first two columns and a different value for the remote frame..
• By clicking on the cell of WebGL Vendor and Render and WebGL2 Params, it looks like the values are not modified in the remote frame and on the local page. Also Web Audio shows the same hash in all three columns..
• Service Worker has different value for Canvas and Accept-Language.

Summary on Chromium:

• It looks like JShelter almost works as it should.
• The problem is that WebGl Vendor and Renderer and Params are not modified by JShelter. It would be worth digging deeper into the problem. Firstly, does this test page take the same values as we do in our test page, or does it use a different API? Are we sure that we modify APIs in time and we do not see a revival of #146 ?
• Web Audio is not modified by JShelter but we should have similar behaviour as Brave and Brave also does not farble Web Audio in a way that is visible on that page.
• I see some fishy behaviour like the Speech Voices that at this time cannot attribute to JShelter but I can be wrong.

Additional note:

• As Brave propagates farbling to the original window, that page can clearly detect that the browser has some modifications. Is that a problem? Possibly yes because it can correlate the fingerprint computed by the remote frame with the one computed by the visited page.
• A possible solution: propagate the hash that influences farbling from the visited domain to the frames.