WebGPU: Your GPU Is Your Passport

Two laptops. Same make, same batch, bought the same day from the same shop. Identical OS, identical browser, identical settings. Line them up, load one website. Every single time, the site cleaves one from the other.

Not by cookies. Not by IP. Not by User-Agent. By how their GPUs draw a triangle. One chip finishes 3 milliseconds quicker. Every GPU rolls off the fab line carrying gossamer drifts in transistor threshold voltages, trace resistance, gate oxide thickness. You can't spot these with bare eyes or gauge them with calipers. Can't patch them out with a driver update. Yet JavaScript running inside a plain browser tab picks them up cold.

Researchers at Ben-Gurion University and Inria christened their work Drawnapart and published it at NDSS 2022. Speed scatter across GPU execution units forges a one-of-a-kind device stamp from plain JavaScript. No special rights, no pop-ups, no user consent. End result: a 67% lift in median tracking length over the strongest known method at the time, FP-Stalker. Works on nominally interchangeable devices. Same model, same batch, same factory floor.

Switch browsers. Switch operating systems. Fire up a VPN, Tor, incognito. Your GPU stays soldered to the board. Not a setting. Physics. Only cure is a whole new machine.

Now picture those triangle-drawing fragment shaders gaining an older sibling, one with raw access to GPU compute cores, no middlemen, no fixed-pipeline guardrails. WebGPU is that sibling.

In brief: WebGPU hands web pages direct access to GPU compute pipelines. Three layers of fingerprinting crack open at once: API parameters, execution timing, and silicon-level chip variation. Attackers can also spy on other tabs, harvest keystrokes, and pull encryption keys. W3C knows. W3C shipped it anyway.

What WebGPU Is and Why You Should Care

WebGL landed in 2011 and gave browsers a peephole onto the graphics card. A cramped peephole. You could draw things: triangles, textures, effects. Everything funneled through a fixed-function graphics pipeline built for one job, wrestling 3D scenes into screen pixels. An engine behind plate glass. You look. You don't touch.

WebGPU smashed that glass.

Ratified as a W3C standard in 2023, live in Chrome since version 113, shipping in Safari 26+, experimentally on in Firefox, WebGPU bolted compute pipelines right onto the rendering stack. A web page can now fire off arbitrary GPU workloads: neural nets, physics sims, scientific number-crunching, real-time video work. Nobody's politely asking for a 3D model here. Thousands of cores, handed over wholesale, with a breezy go wild.

Leap from WebGL to WebGPU mirrors the gap between a pocket calculator and a full-blown workstation. Calculator crunches arithmetic. Workstation runs whatever you feed it. WebGL drew pictures and leaked data through canvas fingerprinting on the sly. WebGPU does everything a GPU can do and bleeds data the canvas-randomization crowd never dreamt of. Canvas randomization, as it happens, has already been beaten. An entirely separate rabbit hole.

Buried in the W3C spec sits a sentence that sparked this whole piece. Authors wrote it in plain daylight: WebGPU compute pipelines expose access to GPU unobstructed by the fixed-function hardware, posing an additional risk for unique device fingerprinting. They penned the warning. Then ratified the standard anyway. Nailing a sign reading Caution: Unlocked to the front door and leaving town for the weekend.

Three Layers of GPU Fingerprinting

GPU fingerprinting isn't one trick. Three layers stack, and each cuts deeper than the last.

The Business Card

Simplest layer. Call navigator.gpu.requestAdapter(), get back a roster of features and limits. Max buffer size, workgroup count, texture formats, binding ceiling. Every GPU ships its own numbers, a business card: name, title, firm. Not a lone identifier on its own, yet a sturdy foothold for narrowing down who you are.

WHOX checks this through F04, the WebGPU features bitmask, and F05, the limits signature. Enough data to pin a GPU family down to the generation. An Nvidia RTX 3060 and an RTX 4070 spit out different limit sets. Intel UHD 770 and Apple M2 GPU yield wholly disparate feature rosters. Two RTX 3060s, though, hand back identical numbers.

Right there, the second layer kicks in.

The Voice

Middle layer. Not what the GPU reports, but how fast it grinds. Shader build time, compute throughput, memory bandwidth, pipeline lag. Every device finishes the same task in a slightly different span, even two units off the same production line. Same way you'd tell two folks with identical names apart over a phone call: the cadence betrays them.

Hohentanner, Kemmerzell, and Florschütz nailed this down in their WiSec 2025 study, Unveiling Privacy Risks in WebGPU. Hardware fingerprinting through GPU execution behavior. Crux of it: the attack sidesteps canvas noise, User-Agent spoofing, every existing privacy shield. Gauges not what the GPU answers but how the GPU toils. Re-identifies devices across sessions without breaking a sweat. Cleared your cookies? Useless. Switched browser profiles? Useless. Opened a private window? Still useless. Your GPU grinds the same way regardless of what the privacy toggles say.

WHOX catches this as F21: GPU timing fingerprint.

The DNA

Deep layer. Drawnapart territory. Manufacturing scatter between chips meant to be twins.

Hardware security folk have a name for this: PUF, Physical Unclonable Function. PUFs drive chip authentication, anti-counterfeiting, cryptographic key seeding. Blunt idea: every transistor on a die carries tiny drifts from the blueprint. Threshold voltage off by fractions of a millivolt. Trace length off by nanometers. Gate oxide thickness off by angstroms. Singular, irreproducible, like human fingerprints. Can't be cloned. Can't be forged. Can't be scrubbed.

Your GPU bears that same indelible birthmark from fabrication. No software update will shift it. No browser knob will veil it. No VPN will occlude it. Identity etched in silicon.

And here's the perverse twist: the very principle dreamt up to shield hardware now tracks you. Lock became lockpick.

Here's the crux. Drawnapart proved all of this through WebGL, through fragment shaders, the graphics pipeline, oblique and recondite readings. WebGPU grants raw compute-pipeline access with far sharper timing fidelity than WebGL's rendering-centric API. Drawnapart via WebGL was a microphone pressed to the wall. Drawnapart via WebGPU would be a microphone sitting on your desk.

A 67% tracking lift via WebGL turns potentially ruinous with WebGPU compute shaders. Nobody's published Drawnapart-via-WebGPU yet. Gunpowder and fuse share the same room. Nobody's struck a match. Yet.

When Fingerprinting Becomes Espionage

Everything so far has been about identification. Unpleasant, yet livable. Someone spotted you. Didn't eavesdrop. What follows crosses into ground politely called side-channel attacks. In blunter English: spying through the keyhole.

Giner, Czerny, Gruber, Rauscher, Kogler, De Almeida Braga, and Gruss at TU Graz published Generic and Automated Drive-by GPU Cache Attacks from the Browser at AsiaCCS 2024. Testing spanned 11 desktop GPUs: 2 AMD RX, 9 Nvidia GTX/RTX/Quadro. Their attack self-tunes, with primitives auto-calibrating to the target card. Three showpieces follow.

Inter-keystroke timing. When you type, the GPU redraws the screen. Cursor blinks, a glyph lands, a fresh frame renders. Traces linger in the GPU cache. A WebGPU compute shader tucked inside a background ad banner can pick up these timing patterns from a wholly different tab. No cross-tab wiring. No JavaScript hook into keyboard events. No permissions asked.

You're typing your banking password. A banner ad is reading it through the graphics card.

AES key recovery. Ten million measurements through the GPU cache side channel, and an AES encryption key tumbles out of the timing data. Not a device fingerprint anymore. A full-blown cryptographic side-channel attack, from a web page, without a single permission. Your GPU encrypts data for one app while a hostile site snoops on that same silicon. No fence between their workload and yours.

Covert channel pushing data at 10.9 kB/s. Two tabs swapping bits through the GPU cache, skirting every browser isolation wall.

All from the sandboxed WebGPU setting. Under 15 minutes for a drive-by strike. You visited a site, drank your coffee, left. Attack done.

The Spy in the Compute Stack

WebGPU-SPY, by Ferguson, Wilson, and Naghibijouybari, also at AsiaCCS 2024, marks the first GPU cache side-channel attack where the compute stack spies on the graphics stack. A compute shader silently watches what the rendering pipeline draws, from another tab or page. Website identification accuracy among the top 100 sites: 90%.

Mechanics are almost insultingly simple. Graphics pipeline renders a page. Different pages stamp different load patterns onto the GPU. Patterns show up in cache state. Compute shader reads that cache state and works out what's being drawn.

Two tabs open. One is your bank. One is a news site with ads. Ads know you're on the banking site. Not from cookies. Because the GPU told them, unwittingly, through shared cache lines.

The Accomplice: WebAssembly

Old-school JavaScript fingerprinting has a soft spot: it can be caught. Browser extensions parse API calls, script signatures, behavioral patterns. Privacy Badger, uBlock Origin, CanvasBlocker: all hunt known tells. Spot a fishy canvas.toDataURL() call and it gets blocked. Catch font enumeration and it gets flagged. Imperfect, yet functional.

WebAssembly wrecks that whole arrangement.

WASM Cloak, published on arXiv in August 2025, showed attackers folding fingerprinting JavaScript into WASM binary form to hide hostile logic from every watcher in the browser. Extensions can't peer inside WASM modules the way they peer inside JS. JavaScript is text you can read and sift. WASM is compiled binary. Opaque, unreadable, a tenebrous blob invisible to current shields. Anti-fingerprinting tools hunt known JavaScript API calls. WASM vaults clean over that detection model. Cops learn to tap phone calls; crooks switch to sign language.

On a separate track, Ben-Gurion researchers Guri and Fibert posted Browser Fingerprinting Using WebAssembly on arXiv in May 2025. Showed the obverse: WASM timing gaps distinguish Chromium-based browsers from each other, Chrome versus Edge, even with User-Agent fully spoofed. Under 1% false-positive rate. Method leans on CPU-bound operations, memory tasks, and I/O activity. Validated on Intel, AMD, ARM. Also unmasks virtual machines: VMware, KVM, VirtualBox. WHOX checks this as F22: WASM timing fingerprint.

Splice those two findings together and something genuinely frightening takes shape. WASM hides fingerprinting code from watchers. WebGPU reads hardware-level signals no software can fake. Combined, they spawn fingerprinting that runs as opaque compiled code measuring hardware behavior beyond any software toggle. Current defenses see neither the code, because WASM, nor the data, because hardware. An invisible thief stealing what can't be hidden.

W3C: We Know, and We Shipped It

In June 2022, the W3C Privacy Interest Group, known as Ping, raised Issue #3101 on WebGPU's fingerprinting surface. Talks began. Two and a half years of talks. Comments, meetings, proposals, counter-proposals, the bureaucratic gavotte you'd expect from a standards body with competing corporate backers.

December 2024 brought the verdict: providing hardware-accelerated access to the GPU at all would grant some fingerprinting surface.

They owned the problem. Shipped the standard anyway. Not because they couldn't mend things. Because mending means gutting the API.

A deliberate blueprint choice. WebGPU's usefulness outweighs user privacy in their calculus. Browsers need in-browser AI inference: faster than round-tripping data to a server. Need 3D rendering for architecture, medicine, teaching. Need scientific computing for research that once demanded native apps. All sound. All helpful.

Side effect: every WebGPU user is inherently trackable. Standards body told you straight. Door's unlocked, and no lock is planned.

WHOX check C40 flags a byproduct of this choice: the WebGPU-vs-WebGL paradox. Browser backs WebGPU? Shrinks the crowd. Doesn't back WebGPU? Also shrinks the crowd. Sheer presence or absence of the API is itself a fingerprint. C54 flags another wrinkle: a mismatch between the WebNN backend and the software renderer, when a browser claims one tier of GPU backing and really uses another. Common in virtual machines, servers with GPU passthrough, and antidetect browsers running half-baked emulation.

More on where fingerprinting heads after WebGPU in our WebGPU, QUIC, and eBPF overview.

What You Can Do

Honestly? Not a lot.

Chrome: WebGPU ships on by default since version 113. Flipping it off via chrome://flags/#enable-unsafe-webgpu is doable, yet breaks a growing stack of sites leaning on WebGPU for AI inference and graphics. Google is ramming WebGPU through as the bedrock for AI in the browser. Turning it off is swimming upstream against a very determined current.

Antidetect browsers fake the API layer: features, limits, adapter name. Business card gets forged. Execution timing and silicon scatter, though, can't be faked. Not data the browser hands over. Physics the browser doesn't steer. Server-side fingerprinting lands at the same answer by a different road.

Tor Browser doesn't back WebGPU yet. Shields you from WebGPU fingerprinting while minting another binary signal: this user lacks WebGPU. In a world where 70%+ of desktop Chrome installs carry WebGPU, missing the API says more than having it.

WHOX - We tell real signals from manufactured ones. Check your fingerprint at whox.com and find out what signals leak from your browser and how unique you are.

FAQ

Does WebGPU fingerprinting work in incognito? Yes. Incognito wipes cookies and history. Your GPU is the same hunk of silicon. Birthmark doesn't hinge on browser mode, just as it doesn't hinge on the weather outside.

Can I spoof GPU data? API layer, features and limits, yes. Timing and silicon scatter, no. Faking your voice works in a text chat, falls apart on a live call. WHOX checks both layers and spots the gaps.

Is this desktop-only? No. Mobile GPUs from Qualcomm Adreno, ARM Mali, and Apple carry the same manufacturing scatter. WebGPU runs in mobile Chrome and Safari. Drawnapart was tested on handsets and it worked.

Can a banner ad truly steal my password through the GPU? TU Graz showed inter-keystroke timing extraction via GPU cache from a WebGPU compute shader under lab conditions. On 11 desktop GPUs. Academic so far, not spotted in the wild. Yet. All the makings sit on the table.

Does W3C plan to fix this? W3C explicitly concluded in December 2024 that the fingerprinting surface is inherent in hardware GPU access. Fixing it means ripping out the API. Nobody's ripping out the API. Too much money on the table.