For example, if a Python IDE or a PostgreSQL server is installed on your computer, you are very likely to be a backend developer.ĭepending on the apps installed on a device, it may be possible for a website to identify individuals for more sinister purposes. The list of installed applications on your device can reveal a lot about your occupation, habits, and age. Profiling based on installed appsĪdditionally, the scheme flood vulnerability allows for targeted advertisement and user profiling without user consent. It’s possible to link your Safari visit to your Chrome visit, identify you uniquely and track you across the web. A website exploiting the scheme flooding vulnerability could create a stable and unique identifier that can link those browsing identities together.Įven if you are not a Tor Browser user, all major browsers are affected. They may use Safari, Firefox or Chrome for some sites, and Tor for sites where they want to stay anonymous. Tor Browser is known to offer the ultimate in privacy protection, though due to its slow connection speed and performance issues on some websites, users may rely on less anonymous browsers for their every day surfing. No cross-browser anonymityĬross-browser anonymity is something that even a privacy conscious internet user may take for granted. The scheme flooding vulnerability allows for third party tracking across different browsers and thus is a violation of privacy. The vulnerability uses information about installed apps on your computer in order to assign you a permanent unique identifier even if you switch browsers, use incognito mode, or use a VPN. We will be referring to this vulnerability as scheme flooding, as it uses custom URL schemes as an attack vector.

The desktop versions of Tor Browser, Safari, Chrome, and Firefox are all affected. In our research into anti-fraud techniques, we have discovered a vulnerability that allows websites to identify users reliably across different desktop browsers and link their identities together. Test the vulnerability on our live demo site.

To help fix it, we have submitted bug reports to all affected browsers, created a live demo and have made a public source code repository available to all. We believe that vulnerabilities like this one should be discussed in the open to help browsers fix them as quickly as possible. We focus on stopping fraud and support modern privacy trends for removing third-party tracking entirely. In this article we introduce a scheme flooding vulnerability, explain how the exploit works across four major desktop browsers and show why it's a threat to anonymous browsing.ĭISCLAIMER: FingerprintJS does not use this vulnerability in our products and does not provide third-party tracking services.

Safari or chrome or firefox