Firefox 145 implements new fingerprinting protections based on large-scale privacy research

Mozilla has released new privacy protections in Firefox 145 designed to combat cookie-less browser fingerprinting. This technique allows trackers to identify users by combining hardware and software details, such as screen resolution, available fonts, and graphics hardware, into a unique profile. The new updates aim to make a larger number of Firefox users appear identical to tracking scripts, thereby degrading the precision of fingerprinting attempts.

The implementation is based on research involving nearly 25 million users, utilizing OHTTP to ensure telemetry data remained anonymous during the study. While some protections are active by default in all browsing modes, others are initially rolled out in Private Browsing and Strict Enhanced Tracking Protection modes. The goal is to provide measurable privacy improvements without breaking the functionality of standard web services.

Technical implementation of fingerprinting mitigation

• API Data Masking: Firefox now limits information exposed through screen resolution APIs to hide the specific size and position of system taskbars or docks, preventing desktop layout details from being used as identifiers.
• Hardware Abstraction: The browser can report processor counts as standardized values (such as 4 or 8) rather than exposing the exact hardware count to reduce device distinctiveness.
• Signal Consistency: New mitigations provide more consistent outputs for image rendering, Web Audio, and mathematical operations on Android to prevent hardware-specific variations from being used as fingerprints.
• Randomization and Segmentation: The browser employs randomization of other fingerprinting signals and utilizes Total Cookie Protection to segment stateful identifiers across different sites.

Why it matters

These changes increase the difficulty for advertisers and trackers to build persistent profiles of users without relying on cookies. For privacy-conscious users and developers, this represents a shift toward standardized browser behavior that prioritizes anonymity over granular hardware reporting.