Ovobrowser: a source-level Chromium fingerprint kernel for Windows x64
源码级 Chromium 指纹内核，检测站按普通 Chrome 评分。Source-level Chromium fingerprint kernel that passes bot detection tests. Not JS injection — C++ patches compiled into the binary.
At a glance
- What is it?
- Ovobrowser patches fingerprint surfaces in Chromium C++ and ships the result as a portable chrome.exe. It is aimed at teams whose automation is already blocked by bot detection, and it only runs on Windows x64 today.
- Who is it for?
- Adopt ovobrowser if your scraping or agent stack already runs on Windows x64 and you are tired of CDP and Function.toString artifacts leaking through. Do not adopt it if your fleet is Linux or macOS, or if you need a documented API to drive fingerprint profiles from code, because the project ships a chrome.exe and a flag list rather than a library.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 22 days ago.
- What is it written in?
- GitHub does not report a main language for this repository.
Answers come from the project's GitHub data, last synced on September 17, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The problem ovobrowser targets: patched runtimes, not missing fingerprints
Most anti-detect setups fail for the same reason. They do not fail because a property is missing. They fail because the property was written by JavaScript after the page loaded, and detection vendors compare the result against what a real Chrome build produces. The README draws this line explicitly: playwright-stealth and puppeteer-extra are described as runtime patches, while ovobrowser is described as Chromium C++ source changes compiled into the binary. The stated consequence is that a detection site sees an ordinary Chrome API surface, because the binary is Chromium.
The project is for people running browser automation at a scale where a single detection vendor flagging the session costs money: scraping pipelines, account operations, and the ai-agents and browser-automation topics the repository lists. It is not for someone who wants a normal browser with a few privacy extensions. The README says the product name is changed to ovobrowser in places like the task manager, the about page and the default user data directory, while the UA string and Client Hints deliberately keep reporting Chrome, on the reasoning that reporting ovobrowser would be scored as an unknown browser. That split is the whole design in one sentence.
How the kernel works: five noise classes and a flag-driven surface
Two rules govern everything. Per the README, if you pass no flag, the kernel behaves like the upstream or real-machine default; if you pass a flag, the value you gave is applied. There is no separate profile file and no configuration server. The surface is set on the command line.
The fingerprint surface is grouped. Navigator and UA-CH flags cover userAgent, brands, platform, platformVersion, hardwareConcurrency, deviceMemory, doNotTrack, the battery object and the speech voice list. Screen flags cover width, height, avail sizes, devicePixelRatio, colorDepth and pixelDepth. GPU and network flags cover the WebGL UNMASKED_VENDOR_WEBGL and renderer strings, WebRTC IP handling, and hiding WebGPU and Bluetooth. Separately, five noise classes are generated: Canvas, WebGL, Audio, ClientRects and Font. The README states each can be turned off or fixed to a seed. The 144 and 150 kernels are described as having more complete audio noise and canvas noise aligned between the main thread and workers, which is the kind of detail that matters, because canvas readback from a Worker that disagrees with the main thread is itself a signal.
One constraint is worth repeating because it is easy to get wrong. The README says the version slot in the UA string must be major.0.0.0, and the full patch number belongs only in --fingerprint-brand-version. Writing the full patch number into the UA is stated to cost points on BrowserScan as a different browser version. The screen width and height flags are defined as CSS logical pixels, and the README warns that omitting --fingerprint-device-scale-factor falls back to the host machine scale factor, which leaks the real machine. Screen size and DPR are meant to be chosen as a pair.
Installing ovobrowser and running the first FingerprintJS-ready session
There is no installer and no package manager entry. The README says to download a zip from the v1.0.0 release, extract it, and use the chrome.exe inside. Three portable kernels are published: 150 (marked recommended, version 150.0.7871.124), 144 (144.0.7559.132) and 138 (138.0.7204.183). All three are Windows x64.
The README's own examples set three environment variables first, so the commands below stay readable. The names are OVO_CHROME, OVO_PROFILE and OVO_URL.
set OVO_CHROME=D:\ovobrowser-150\chrome.exe
set OVO_PROFILE=D:\ovobrowser-profiles\acc01
set OVO_URL=https://demo.fingerprint.com/playgroundThen launch the kernel. The README calls the command below the FingerprintJS Pro all-green skeleton: no noise enabled and no GPU string spoofed. Note the UA version slot, which is 150.0.0.0 while the brand version carries the full patch number.
chrome.exe --user-data-dir=D:\ovobrowser-profiles\acc01 --no-first-run --no-default-browser-check --disable-quic --fingerprint-platform=windows --fingerprint-brand=Chrome --fingerprint-brand-version=150.0.7871.124 --fingerprint-platform-version=10.0.0 --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" --fingerprint-screen=1536x864 --fingerprint-device-scale-factor=1.25 --fingerprint-screen-color-depth=24 --fingerprint-hardware-concurrency=8 --fingerprint-device-memory=8 --timezone=America/New_York --lang=en-US --accept-lang=en-US,en --webrtc-ip-handling-policy=disable_non_proxied_udp https://demo.fingerprint.com/playgroundWhat you should see: the playground page loads and the fingerprint checks come back clean rather than flagged. The README is explicit that the timezone, lang and accept-lang values must be changed to match the location of your exit IP. Leaving America/New_York while egressing from elsewhere is a mismatch you created, not a kernel defect. The repository also carries example launchers under examples/ for python, nodejs, go, csharp, java, powershell and rust, so you can build the argument list in the language your pipeline already uses instead of shelling out from a batch file.
What ovobrowser does not do: Windows-only, no library, no rollback story
The distribution is the limitation. Every published asset in v1.0.0 is a win64 portable zip. There is no Linux build, no macOS build, no Docker image and no headless server package in the release list. If your scraping fleet runs on Linux containers, this project does not fit it today, and the README does not describe a roadmap for that.
There is also no client library. The integration surface is a command line and a set of --fingerprint-* switches. The README points users who want environment management, proxies, teams and window synchronization at a separate graphical client, ovobrowser-manger, which is a different repository with its own download page. If you need to drive profiles from code, you are assembling process arguments yourself.
Version pinning is a real operational cost. The project publishes discrete kernels rather than a rolling channel, and the README frames the upgrade model as rebasing with each kernel version. That means a Chrome security release does not reach you until a matching ovobrowser kernel is published. The README does not document a rollback procedure or a compatibility matrix between kernels, so if a specific site starts failing after you move from 144 to 150, there is no stated path back other than keeping the older zip. Keep the old archive.
Finally, the detection list in the README is a list of demo and scanner pages, including demo.fingerprint.com, browserscan.net, bot.sannysoft.com, bot-detector.rebrowser.net, abrahamjuliot.github.io/creepjs, fingerprint-scan.com, scrapingcourse.com and deviceandbrowserinfo.com. Those are test pages, not production targets. Passing them is evidence that the surface is coherent, not a guarantee about the specific site you care about.
Ovobrowser versus CDP-based stealth: where the difference actually shows
The obvious alternative is the stealth-plugin route: puppeteer-extra with a stealth plugin, playwright-stealth, or undetected-chromedriver. The README names those directly and puts them in the injection column of its comparison table. The difference is not effort or polish, it is where the value comes from. An injected patch runs inside the page's JavaScript context, so the value it writes has a history: the property descriptor, the function source, the call stack that produced it. A detection script can ask those questions without knowing anything about fingerprints.
Ovobrowser's approach is that the value is produced by the same C++ code path that produces it in stock Chromium, so there is no patch to observe. The trade-off is that you cannot change it at runtime. There is no evaluate-on-new-document hook, no per-page override, no way to mutate a fingerprint after the browser has started. Everything is decided at process launch. That is a real loss of flexibility, and it is the price of the mechanism.
A second alternative is a commercial anti-detect browser with a GUI. The README acknowledges that audience by pointing ordinary users at the graphical ovobrowser-manger client, which handles environments, proxies, teams and window sync. If your team is not comfortable composing a 15-flag command line, the CLI path is the wrong entry point even though the kernel underneath is the same idea.
Licence, upgrade cadence and the cost of staying current
The repository is MIT licensed, and the LICENSE file sits at the top level. MIT is permissive, so the practical implication is that you can ship the binary inside a product without a copyleft obligation. One thing to check rather than assume: the portable package is a compiled Chromium binary, and Chromium itself carries its own third-party licence notices. The README does not discuss how those notices are bundled in the zip, so if you redistribute the kernel, confirm what licence files travel with it. That is a question for your own counsel, not a claim this article can settle.
On cadence, the last push to the repository was on 2026-08-27, and v1.0.0 was published on 2026-08-23. The release bundles three kernels at once rather than tracking upstream Chrome point releases. Practically, that means your upgrade decision is a version choice, not a patch stream: you pick 138, 144 or 150 and you stay there until the next release. The README notes that 150 is friendlier to the FingerprintJS ML model, and that the three kernels share roughly the same switch set, with 144 and 150 having more complete audio noise and main-thread/worker canvas alignment. If you are on 138 for compatibility with something else, you are accepting a weaker noise implementation.
Editorial conclusion
Adopt ovobrowser if your scraping or agent stack already runs on Windows x64 and you are tired of CDP and Function.toString artifacts leaking through. Do not adopt it if your fleet is Linux or macOS, or if you need a documented API to drive fingerprint profiles from code, because the project ships a chrome.exe and a flag list rather than a library. Before committing, verify three things yourself: that your target site is actually in the detection list the README publishes, that the timezone and lang flags you pass match your exit IP, and that the kernel version you download is the one your UA string claims.
Frequently asked questions
What is ovobrowser on my computer?
It is a portable Chromium build from the ovobrowsersupport/ovobrowser repository, distributed as a zip containing chrome.exe. The README states the product name is changed to ovobrowser in places such as the task manager and the about page, while the UA string and Client Hints still report Chrome.
Which browser is not safe to use?
The README does not rank browsers by safety, so this cannot be answered from it. What it does describe is a different risk: injected stealth tools leave patch artifacts and CDP traces that detection sites can observe, which is the problem ovobrowser claims to avoid by patching Chromium in C++ instead.
How do I check if my browser is hacked?
The repository does not cover malware or compromise checks. It does list scanner pages it says the kernel passes, including bot.sannysoft.com, browserscan.net, creepjs and demo.fingerprint.com/playground, which you can open to see how a browser is scored rather than whether it is compromised.
What is the safest browser to use?
This is outside what the repository documents. Ovobrowser is a Windows x64 portable kernel aimed at automation that must not be flagged by bot detection, and the README does not make any security or safety comparison against other browsers.
Community notes