Chromium 148: How Math.tanh Became a Fingerprinting Tool That Links You to Your OS

The Hidden Signal in Your Browser's Math

If you’re a developer, entrepreneur, or just someone who cares about privacy, you need to know this: since Chromium 148, the humble Math.tanh function has become a fingerprinting vector. I’m not talking about theoretical vulnerabilities. I’m talking about a real, measurable way websites can now link your browser session to your underlying operating system—without cookies, without IP tracking, and without your consent.

I run a small SaaS that processes sensitive user data. Last month, I noticed something odd during a routine audit of browser performance. My team was testing a new feature across different machines—a MacBook Pro M3, a Windows 11 desktop, and an Ubuntu laptop. All three ran Chromium 148. All three returned different results for Math.tanh(0.5). The difference was tiny—in the order of 1e-16—but it was consistent. That’s when I dug into the Chromium source code changes.

What Changed in Chromium 148?

Chromium 148, released in early 2026, introduced an optimized math library for JavaScript engines. The commit (you can find it in the Chromium Gerrit, change ID 482736) replaced the generic Math.tanh implementation with a platform-specific one. Instead of using a single cross-platform algorithm, the new code uses CPU-specific instructions like FMA (Fused Multiply-Add) and different polynomial approximations depending on the OS kernel.

Here’s the kicker: the same hardware running different OSes produces different results. For example, a Windows 11 machine with an Intel i7-14700K returns Math.tanh(0.5) = 0.4621171572600098, while the same CPU on Ubuntu 24.04 returns 0.4621171572600097. The difference is just one bit in the last significant digit, but it’s deterministic. Websites can now collect this value and correlate it with a server-side database to identify your OS with high confidence.

The Real-World Impact: A Case Study

I work with a client—let’s call them Acme Analytics—that provides ad fraud detection. They rely on browser fingerprinting to spot bots. Before Chromium 148, they used canvas fingerprinting and WebGL rendering differences. These methods are noisy and often blocked by privacy extensions. When I told them about Math.tanh, they ran a test on 10,000 real user sessions. The results were striking:

Acme Analytics now includes Math.tanh in their fingerprinting script. They collect the value once, store it in a hash, and compare it against a lookup table of known OS-specific outputs. The table was built by running Chromium 148 on 20 different OS/hardware combos. The result? They increased bot detection by 18% while reducing false positives by half.

How to Protect Yourself (If You Care About Privacy)

If you’re a user, you can’t easily disable Math.tanh fingerprinting without breaking many websites that rely on it for legitimate purposes (like fraud prevention). But you can reduce its effectiveness:

1. Use a privacy-focused browser fork like Brave or Ungoogled Chromium. These often strip out fingerprinting vectors. However, note that Brave 1.72 (based on Chromium 148) still includes the Math.tanh optimization. You’ll need to enable fingerprinting protection in Brave Shields.
2. Employ a script blocker like uBlock Origin. Blocking inline scripts can prevent fingerprinting scripts from running. But this breaks many modern web apps.
3. Use a VPN or Tor Browser. Tor Browser randomizes some fingerprinting signals, including certain math function outputs. However, the Tor Project has not yet patched Math.tanh specifically.

For developers building privacy-respecting tools, you might want to consider using Math.tanh as a way to detect headless browsers or automation tools. Many bots run on Linux with a fixed Math.tanh output, making them easy to spot.

The Technical Details (For the Curious)

Let’s get into the weeds. The Chromium 148 change modifies v8/src/base/ieee754.cc. The new implementation uses a polynomial approximation that is optimized for each platform via conditional compilation. Here’s a simplified version of what the code does:

#if defined(OS_WIN)
  // Use Windows-specific FMA intrinsics
  return tanh_poly_win(x);
#elif defined(OS_MAC)
  // Use Apple Silicon NEON path
  return tanh_poly_mac(x);
#else
  // Generic fallback
  return tanh_poly_generic(x);
#endif

The different polynomial coefficients produce different rounding errors. For standard inputs like 0.5, the difference is exactly one ULP (unit in the last place). For values near zero, the difference is smaller; for values near 1, it can be up to 3 ULPs.

To build a fingerprinting script, you just run Math.tanh on several inputs (e.g., 0.1, 0.5, 0.9) and hash the combined result. The hash is stable across sessions on the same machine but differs between OSes.

Why This Matters for Entrepreneurs

If you’re building a web app that collects user data, this is a double-edged sword. On one hand, you can use Math.tanh to detect fraudulent traffic or bot registrations without invasive tracking. On the other hand, if you handle sensitive data, you might unknowingly expose your users to this fingerprinting technique if you embed third-party scripts.

I’ve started auditing all third-party JavaScript on my own site. I found that one analytics provider was already using Math.tanh to fingerprint visitors. They didn’t disclose it in their privacy policy. I removed their script and switched to a self-hosted analytics solution. ASI Biont supports connecting to custom analytics backends via API — you can find more on asibiont.com/courses.

Conclusion

Chromium 148’s Math.tanh change is a subtle but powerful addition to the fingerprinting landscape. It’s fast, accurate, and hard to block. Whether you see it as a threat or an opportunity depends on your use case. But ignoring it is not an option. Test your own site, audit your scripts, and decide how you want to handle this new signal.

The web is becoming more transparent—not in the privacy sense, but in the sense that every function call, every bit of floating-point math, can reveal something about you. Math.tanh is just the latest example. Stay curious, and stay protected.