# What is WebGL fingerprinting? > WebGL fingerprinting reads the GPU vendor and renderer strings, dozens of driver limits and a rendered image, which together identify your GPU. Source: https://mosaicbrowser.com/glossary/webgl-fingerprinting ## WebGL fingerprinting: what your graphics card tells a page WebGL fingerprinting is reading what the browser's WebGL API reveals about the graphics hardware: the unmasked GPU vendor and renderer strings, dozens of driver limits and supported extensions, and the exact pixels of a rendered scene. Together they identify the GPU and driver, and expose a spoof that renames it. ![WebGL fingerprinting, drawn as a mosaic of tiles](https://mosaicbrowser.com/covers/webgl-fingerprinting.webp) WebGL is how a web page draws 3D on your graphics card, and before it draws anything it gets told what the card is. The chip's name, the largest texture it takes, which driver features exist. A fingerprinting script asks for all of it and never draws a pixel you would see. No other browser API says as much about the hardware. ## What WebGL fingerprinting reads The first call most scripts make is to an extension Chrome exposes as `WEBGL_debug_renderer_info`. It has two constants, `UNMASKED_VENDOR_WEBGL` and `UNMASKED_RENDERER_WEBGL`, and `getParameter()` turns them into the driver's vendor and renderer strings ([MDN](https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_info), read 2 November 2026). In Chrome the renderer names the actual chip. An M2 MacBook says: ``` ANGLE (Apple, ANGLE Metal Renderer: Apple M2, Unspecified Version) ``` and on Windows, through Direct3D: ``` ANGLE (NVIDIA, NVIDIA GeForce RTX 4060 (0x00002882) Direct3D11 vs_5_0 ps_5_0, D3D11) ``` Behind the strings sits what we call the capability record: around sixty more values from `getParameter()`, such as maximum texture size, maximum viewport dimensions and vertex attribute counts, plus the shader precision formats and the list of supported extensions. And then the script draws. It renders a small scene, pulls the pixels back with `readPixels()` and hashes them. Two GPUs, or one GPU on two drivers, round a few of those pixels differently. It is the trick behind [canvas fingerprinting](https://mosaicbrowser.com/glossary/canvas-fingerprinting), moved onto the graphics card. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Machines that exist](https://mosaicbrowser.com/features/real-fingerprints) ## Why a spoofed renderer string fails Renaming the GPU is one line of code. Done alone, it backfires: the string now says one chip and the sixty limits under it still describe the other. You don't need a database of devices to see it, only to know that an M2 never came with that extension list or that texture limit. The string itself has to be exact, too, and we learned that the hard way. Every GPU string in our device catalogue was once written by hand, and 41 of the 45 Windows strings were wrong in the same way: they left out the `(0x00002882)` part, the PCI device id ANGLE takes from the driver. A GPU name with no device id is not a rare configuration; no real Chrome on Windows reports one. That fault sat under all the careful work on canvas and audio until we compared the strings with collected data. There is also the question of where the value is read. A page can create a WebGL context inside a worker with `OffscreenCanvas`. If a spoof only covers the page, the page reads one GPU and its worker reads another, and that disagreement is worth more to a detector than either value. ![A profile fingerprint in Mosaic: GPU, screen, fonts, timezone and language matched to the exit](https://mosaicbrowser.com/shots/fingerprint-detail.png) *The GPU is drawn with the rest of one real machine* ## How to check yours Open a WebGL report page, such as [BrowserLeaks' WebGL report](https://browserleaks.com/webgl), and read the unmasked renderer, the extension count and the hash of the rendered image. Now load that page in a second browser on the same computer. Same GPU, so the renderer ought to read the same. In a modified browser, compare the renderer with the limits beneath it. Our guide to [checking your browser fingerprint](https://mosaicbrowser.com/guides/check-your-browser-fingerprint) lists other public pages, including ones that read the same values from inside workers. ## How Mosaic handles it Each profile's hardware is one real device from Mosaic's catalogue, so the GPU comes with the screen, CPU and memory that machine actually ships with ([machines that exist](https://mosaicbrowser.com/features/real-fingerprints) explains the catalogue). We stopped writing renderer strings by hand after the 41-of-45 episode. They now come from collected fingerprints, and the build refuses any catalogue row whose renderer nobody has seen a real browser report. The vendor and renderer strings are set inside Chromium, in C++. A page, an iframe and a worker all read the same GPU. On an Apple Silicon Mac, the chip a profile reports is the computer's own. That rule came from Pixelscan. We changed one thing at a time on one profile: a different thread count passed, a different chip failed. The extension list, the precision formats and the pixels all come from the real driver, and none of them move when the name does. The engine does carry a patch that could claim all sixty capability values. It stays switched off until we have those values collected from real machines. A limit no real driver reports is a louder tell than the honest number. The noise on read-back pixels is seeded per profile: open the profile tomorrow and the image hash is the one it had today. ## Sources 1. [MDN: WEBGL_debug_renderer_info](https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_info), read November 2, 2026 2. [BrowserLeaks: WebGL Report](https://browserleaks.com/webgl), read November 2, 2026 ## Questions ### Does WebGL fingerprinting work in incognito mode? Yes, every bit as well. Incognito throws your cookies away when you close it; it does not swap your graphics card. The renderer string, the limits and the pixel hash all match a normal window. ### Should I disable WebGL to avoid fingerprinting? Probably not. A Chrome with WebGL turned off is rarer than almost any GPU it could report, and Google Maps, browser games and online design tools break without it. A believable GPU, reported the same way in every context, stands out less. ### What is UNMASKED_RENDERER_WEBGL? One of two constants in the WEBGL_debug_renderer_info extension. getParameter(UNMASKED_RENDERER_WEBGL) returns the driver's renderer string; on an M2 Mac that is ANGLE (Apple, ANGLE Metal Renderer: Apple M2, Unspecified Version). ### Can two computers have the same WebGL fingerprint? Often. Two laptops of one model on the same driver, OS and Chrome version will usually hash the same, so no site relies on WebGL alone. It gets read beside the screen size, the fonts and the timezone. ## Related [Canvas fingerprinting: how a drawing identifies your computer](https://mosaicbrowser.com/glossary/canvas-fingerprinting): Canvas fingerprinting draws hidden text and shapes, reads the pixels back and hashes them. Small rendering differences make the hash a mark of your machine. [Browser fingerprint: what a site can read about your machine](https://mosaicbrowser.com/glossary/browser-fingerprint): A browser fingerprint is the set of values a site reads about your browser and computer, which together recognize you without cookies. What goes into one. [Machines that exist: fingerprints drawn from real hardware](https://mosaicbrowser.com/features/real-fingerprints): Mosaic draws each profile's GPU, screen, CPU, memory and fonts from one real device, so the parts of a fingerprint agree with each other and with the host. [How to check your browser fingerprint, and read the result](https://mosaicbrowser.com/guides/check-your-browser-fingerprint): How to check your browser fingerprint: a uniqueness test says how rare it is, a consistency scanner whether it could be real. Run each twice. [An anti-detect browser with its own Chromium engine](https://mosaicbrowser.com/features/engine): Mosaic is an anti-detect browser with its own Chromium engine, Tesseract Chrome: stock source plus 64 patches that change fingerprint values in C++.    ## See webGL fingerprinting on a real profile Mosaic shows the values a site reads, per profile, and runs a leak test from inside the profile’s own page. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.