Cross-browser recognition: what holds, and what we switched off

A person who signs up in one browser and comes back in another is, to a naive fingerprint, two people. That gap is what makes switching browsers a cheap way to get a second free trial. This note explains what LR Defender recognizes across browsers today, what it does not, and why the line sits where it does.

Why browsers disagree

Each browser engine has its own rendering, font and audio code. Two browsers on one machine can draw the same text with slightly different pixels, list different fonts, and round the same audio computation differently. Privacy features add deliberate noise on top. A fingerprint built only from what the browser reports splits one machine into several identities.

What holds today: one engine family

Browsers built on the same engine share most of that code. Chrome and Edge are both built on Chromium, so on one machine they render, list fonts and process audio in nearly the same way. LR Defender's recognition holds across browsers that share an engine, such as Chrome and Edge.

What we switched off: matching across engines

Matching across engines, for example from Chrome to Firefox, is in evaluation and off by default. The difficulty is that the signals which survive a change of engine are mostly hardware signals, and identical machines share their hardware. A match across engines therefore risks joining two different people who bought the same laptop.

An earlier version of this post described matching from Chrome to Firefox, Safari and Brave as working. That matching is in evaluation and off by default, and this version corrects the post.

The research behind it

Academic work has shown how much identity lives in graphics hardware. DRAWNAPART (NDSS 2022) timed short WebGL programs on a GPU's execution units and used the timings to tell apart devices of the same model. It is a strong result in a controlled setting, and it is research: on its own it does not make matching across engines reliable on production traffic.

What this means for you

• If your users move between Chrome and Edge, recognition holds.
• If they move between engine families, treat the browsers as separate devices, and link them with your own account data where you have it.
• Identical machines can look alike. If your users work on identical company laptops, expect some of them to share a device ID, and weigh the other evidence in the verdict.

One hardware check that does work across read paths

One hardware check does cross a boundary inside the browser. The GPU coherence check compares the GPU model reported through independent read paths (WebGL, a worker's offscreen canvas and WebGPU) and flags a browser that reports different models through them. It catches a spoofed graphics card; it does not link two browsers. More on GPU coherence.