2026-05-10 • Web Scraping • Reading time: 10 min • 中文版

CloakBrowser Guide: Stealth Chromium That Bypasses All Bot Detection — Source-Level Fingerprint Patching

Every web scraper and automation engineer knows the pain. You set up Playwright, write clean code, and then—blocked by Cloudflare Turnstile. Or reCAPTCHA v3 gives you a 0.1 score. Or FingerprintJS flags your browser as a bot before you even make a request.

CloakBrowser takes a radically different approach. Instead of patching bot signals at the JavaScript layer (like playwright-stealth) or tweaking configuration flags (like undetected-chromedriver), it modifies Chromium at the C++ source level. The result is a browser binary that looks, sounds, and behaves exactly like a real user's browser — because at the binary level, it is.

On May 8, 2026, CloakBrowser hit 4,500+ GitHub stars and trended on Hacker News. Today we'll dive deep into how it works, how to use it, and why it's the most significant advancement in stealth browsing since Playwright itself.

How CloakBrowser Works: Source-Level Fingerprint Patching

Modern bot detection systems don't just check your User-Agent or look for navigator.webdriver. They analyze dozens of subtle signals:

Canvas fingerprinting — slight rendering inconsistencies reveal automated browsers
WebGL vendor/renderer strings — headless browsers expose different GPU info
AudioContext fingerprinting — audio signal processing artifacts
Font enumeration — system font lists differ between headless and real browsers
Screen properties — colorDepth, pixelRatio, availWidth
WebRTC ICE candidates — real IP leakage through STUN/TURN
Network timing — DNS resolution and connection times expose proxy usage
Automation flags — CDP detection, input behavior anomalies

Existing tools try to mask these signals with JavaScript injection. But JS injection itself is detectable — the timing, the execution order, and the patches themselves can be fingerprinted. CloakBrowser applies 49 C++ patches directly to Chromium 146's source code, fixing every one of these signals at compile time. No runtime injection, no flag manipulation, no detectable patching layer.

Test Results: 30/30 Pass on Major Detection Services

The project's README includes a detailed comparison table. Here are the critical results:

Detection Service	Stock Playwright	CloakBrowser
reCAPTCHA v3 (server-verified)	0.1 (definitely bot)	0.9 (normal user)
Cloudflare Turnstile (non-interactive)	Failed	Passed
Cloudflare Turnstile (managed)	Failed	Single click pass
FingerprintJS	Bot detected	Passed
BrowserScan (4 scores)	Bot flagged	All normal
bot.incolumitas.com	13 failures	1 failure only
deviceandbrowserinfo.com isBot	true	false
ShieldSquare	Blocked	Passed

The reCAPTCHA v3 score of 0.9 is server-side verified — this isn't just a front-end score. It means most sites' bot detection will greenlight CloakBrowser at the first checkpoint, never triggering a CAPTCHA challenge.

Installation: 3 Lines of Code, Drop-In Replace Playwright

Python Quickstart

pip install cloakbrowser

from cloakbrowser import launch
browser = launch()
page = browser.new_page()
page.goto("https://your-target-site.com")
# your scraping code here
browser.close()

Migrating from Playwright is a one-line import change:

# Before:
# from playwright.sync_api import sync_playwright
# pw = sync_playwright().start()
# browser = pw.chromium.launch()

# After:
from cloakbrowser import launch
browser = launch()

JavaScript / Node.js Quickstart

npm install cloakbrowser playwright-core

import { launch } from 'cloakbrowser';
const browser = await launch();
const page = await browser.newPage();
await page.goto('https://your-target-site.com');
await browser.close();

Puppeteer users can use: import { launch } from 'cloakbrowser/puppeteer'

Docker Quickstart

docker run --rm cloakhq/cloakbrowser cloaktest

The first run downloads the stealth Chromium binary (~200MB). It's cached locally for subsequent runs.

Advanced Features

Humanize Mode: Realistic Human Behavior Simulation

Enable humanize=True to automatically simulate:

Mouse movements — Bézier curve paths instead of straight jumps
Keyboard input — character-by-character typing with realistic intervals
Scroll patterns — human reading-rhythm based scrolling

These are implemented via CDP isolated world + trusted dispatch, invisible to behavior analysis systems.

Proxy-Aware Geo-Location & Timezone

pip install cloakbrowser[geoip]
launch(proxy="socks5://user:pass@host:port", geoip=True)

Automatically detects the proxy egress IP's geo-location, sets matching timezone and language. WebRTC ICE candidates are also faked to prevent real IP leakage.

Persistent User Profiles

launch_persistent_context()

Keeps cookies and localStorage across sessions, bypassing incognito mode detection. Essential for logged-in scraping scenarios.

Automatic Fingerprint Randomization

Each launch auto-generates a random fingerprint seed. Canvas, WebGL, Audio and other fingerprints vary within reasonable ranges — not every instance uses the same fingerprint.

CloakBrowser vs. Other Stealth Solutions

Tool	Approach	Detection Difficulty	Price
playwright-stealth	JS injection	Very easy	Free
undetected-chromedriver	Config + JS injection	Medium	Free
Multilogin / GoLogin / AdsPower	Commercial Chromium fork	Medium-Hard	$30-100/mo
CloakBrowser	C++ source-level patches	Extremely hard	Free, MIT

Commercial solutions like Multilogin offer similar capabilities but at $30-100/month and closed source. CloakBrowser is MIT licensed, no usage limits, no subscriptions. The catch: you need to keep your binary updated as Chrome's fingerprint surface evolves, but CloakHQ provides auto-update channels.

Limitations to Know

CloakBrowser does not solve CAPTCHAs — its goal is to prevent CAPTCHAs from appearing. If a site already shows a CAPTCHA, you'll need a solver service
No built-in proxy rotation — you supply your own proxy pool; CloakBrowser ensures each proxy's traffic looks legitimate
Binary updates matter — each Chrome major version may add new detection surfaces; keep the stealth binary updated via the built-in updater

Ideal Use Cases

Web scraping — collect data from Cloudflare-protected sites
AI Agent browser automation — pair with browser-use, Crawl4AI, Scrapling, Stagehand
SEO monitoring — view competitor search rankings and content changes
Ad verification — check ad placements in target markets
Price monitoring — scrape bot-protected e-commerce pricing
Account automation testing — test flows that complex anti-bot systems protect

Getting Started in 60 Seconds

# Python
pip install cloakbrowser
python -c "from cloakbrowser import launch; b=launch(); p=b.new_page(); p.goto('https://bot.sannysoft.com'); print(p.title()); b.close()"

# Node.js
npm install cloakbrowser
echo "import { launch } from 'cloakbrowser'; const b = await launch(); const p = await b.newPage(); await p.goto('https://bot.sannysoft.com'); console.log(await p.title()); await b.close();" | node --input-type=module

Summary

CloakBrowser takes a fundamentally different approach to stealth browsing — not patching at the JS or config layer, but modifying Chromium's C++ source code directly. With 49 fingerprint patches covering Canvas, WebGL, AudioContext, WebRTC, network timing, and automation signals, it achieves remarkable pass rates across modern bot detection systems.

Compared to commercial solutions costing $30-100/month, CloakBrowser is free and open-source under MIT. If you're doing serious web scraping or browser automation and frequently run into anti-bot measures, this is one of the most important open-source projects to watch in 2026.

Project: github.com/CloakHQ/CloakBrowser

Install: pip install cloakbrowser or npm install cloakbrowser