Math.tanh Now Fingers Your Operating System

Since Chromium 148, Math.tanh returns values that differ by OS. Any website can detect it in milliseconds.

Dafallah Ibrahim

— 2 min read
Share

You probably think of Math.tanh as boring math. Hyperbolic tangent. Returns a number between -1 and 1. Useful for ML demos, not much else in daily web work.

Since Chromium 148, it's also a way for any website to identify your operating system — no permission prompt, no API call, no obvious trace.

Why this matters

Browser fingerprinting identifies users by characteristics they can't easily change. Canvas rendering, WebGL vendor strings, installed fonts — privacy browsers already fight these vectors. Math APIs were never on the list. Until now.

A site calls Math.tanh(), compares the result against known per-OS values, and determines whether you're on Windows, macOS, or Linux. Silent and instant.

How it works

The root cause is floating-point approximation. Transcendental functions like tanh can't be computed exactly — they're estimated through series expansions. Different platforms ship different math library implementations, and V8 delegates to the system in certain code paths.

The differences are tiny — usually the last one or two bits of the IEEE 754 double. But they're deterministic. Same input, same OS, same output. Every time.

A fingerprinting script picks a few constants, runs them through Math.tanh, hashes the results, and maps the hash to a specific OS. Done in under a millisecond.

Where this helps

  • Fraud detection: A user claims iOS in their UA string, but Math.tanh says Linux. Probably an emulator or bot farm.
  • Privacy hardening: If you build a privacy-focused browser or extension, add this to your normalization list alongside canvas and WebGL.
  • Bot screening: Headless browsers typically run on Linux servers. If the UA says Windows but the math says Linux, that's a red flag worth scoring.

Watch out

  • This is specific to Chromium 148+. Older versions may not exhibit the same divergence.
  • Firefox and Safari use different JS engines with their own math code paths — your results will vary across browsers too, which actually adds to the fingerprint surface.
  • A Chromium fix could land any time. Don't build critical infrastructure on this signal alone — combine it with others.
  • The exact input values that produce divergence may shift between patch versions.

Try it yourself

Run this snippet on different machines and OSes. Compare the output strings:

// Probe Math.tanh at full double precision
const probes = [0.1, 0.5, 1.0, 2.5, 10.0];
const sig = probes.map(x => Math.tanh(x).toPrecision(17)).join('|');
console.log(sig);
// Same OS + browser → identical string
// Different OS → last digits diverge

TL;DR

  • What changed: Chromium 148 made Math.tanh output OS-dependent at the bit level.
  • Why it matters: Any website can fingerprint your OS with zero permissions or API calls.
  • What to try: Run the snippet on two different machines and diff the results.

Read more