WebGL & GPU Fingerprinting: How Shaders and Renderers Track Devices

How WebGL Exposes Your Graphics Card

The WebGL (Web Graphics Library) API allows browsers to render high-performance 2D and 3D graphics directly on your GPU without plugins. However, WebGL is also one of the most potent browser fingerprinting vectors on the modern web.

---

1. Unmasked Vendor and Renderer Strings

Using the WEBGL_debug_renderer_info extension, any website can execute two lines of JavaScript to query your exact graphics hardware:

• Unmasked Vendor: e.g., Apple, NVIDIA Corporation, Intel Inc.
• Unmasked Renderer: e.g., ANGLE (NVIDIA GeForce RTX 4070 Direct3D11 vs_5_0 ps_5_0) or Apple M3 Max

This immediately classifies you into a small percentage of web users with that exact GPU and driver version.

---

2. Shader Math & Floating-Point Differences

Even if a browser masks the renderer string, websites can compile a hidden 3D shader program and measure microscopic differences in how your GPU calculates floating-point trigonometric functions.

Because different GPU architectures (AMD, NVIDIA, Intel, Apple Silicon) calculate float values with unique hardware tolerances, the resulting rendered image hash is mathematically unique to your device.

---

How to Protect Against WebGL Tracking

1. Inspect Your GPU Signature: Use the Browser Fingerprint Diagnostic to view your WebGL hash.
2. Review Hardware Details: Check your CPU/GPU specs with WhatsMyDevice Device Info.
3. Use Anti-Fingerprinting Browsers: Browsers like Tor and Brave apply uniform Canvas and WebGL noise to prevent deterministic hashing.