# Chameleon: a Random Agent Spoofer rebuilt for the WebExtension era

> Chameleon is a Firefox WebExtension port of the older Random Agent Spoofer add-on, keeping its interface and most of its features while extending the fingerprinting surface well past the user agent string. The README is candid that some of the promised behaviour is not technically possible in a WebExtension, and the project ships a whitelist system with regular expressions for sites where you want your real profile back.

**sereneblue/chameleon** — WebExtension port of Random Agent Spoofer

- Repository: https://github.com/sereneblue/chameleon
- Website: https://sereneblue.github.io/chameleon
- Stars: 696 · Forks: 68
- Language: TypeScript
- License: GPL-3.0
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/sereneblue-chameleon

## A port that kept the old interface

Chameleon is a WebExtension port of the Firefox add-on Random Agent Spoofer, by dillbyrne, and the README credits the original creator for it. The relationship is stated plainly rather than disguised: the UI is near identical and contains most of the features found in the original extension.

That framing matters for how you evaluate it. This is not a new design with a new threat model, it is an older privacy add-on rebuilt on a newer extension API, and the code credits reflect that, with the CSS Exfil protection code by Mike Gualtieri also acknowledged in the credits section.

The primary language is TypeScript, the project is published as chameleon-ext, and the package description says it spoofs your browser profile and includes a few privacy enhancing options. The homepage is at sereneblue.github.io/chameleon, and the licence is GPL-3.0 with the text in LICENSE.md.

For the audience this matters, the interesting question is not whether the feature list is long, which it is, but which of those features a WebExtension can actually deliver. The README answers that directly in one line, and the rest of this article is largely about that boundary.

## Headers: the part that works best

The headers group is the most conventional part of the feature set, and the most likely to behave as advertised because browsers expose a real API for request modification.

The list covers enabling Do Not Track, preventing Etag tracking, spoofing accept headers, spoofing the X-Forwarded-For and Via IP, disabling the referer, and modifying referer policies. Etag caching is a real fingerprinting vector because a server can tell whether your client supports it, and referer handling is another because the header tells a third party which site you came from.

The X-Forwarded-For and Via spoofing is the one to think about carefully rather than just tick. A browser that lies about its forwarding headers produces a request that does not match what a real network path would send, and some sites compare that against their own logs. The feature list does not explain the semantics, so if you enable it, the sensible thing is to check that the sites you care about still behave.

The accept header spoofing belongs to the same family, and it interacts with the user agent selection, because a user agent claiming one platform while the accept header claims another is an inconsistent fingerprint. Chameleon lets you pick a browser profile, so in principle the values can be made to agree, and consistency is exactly what a fingerprinting script is looking for.

## The options list is where the WebExtension ceiling shows

The options group is long: block media devices, limit tab history, protect the keyboard fingerprint, protect window.name, spoof the audio context, spoof client rects, spoof the font fingerprint, spoof screen size, spoof the timezone, enable first party isolation, enable resist fingerprinting, prevent WebRTC leak, enable tracking protection, block WebSockets and modify the cookie policy.

Some of these are straightforward for an extension, and some are not, and the README does not pretend otherwise. It states plainly that WebExtensions are unable to modify about:config entries, and the contribute section says to keep in mind that some functionality isn't technically possible.

That single sentence reframes the whole list. An option like resist fingerprinting or first party isolation is normally a browser preference, and if the implementation would need a preference, the extension cannot set it from inside the extension process. The same applies to anything that depends on a privileged API. So the honest way to read the options list is as the project's intent, with the actual behaviour of each toggle depending on what the WebExtension platform exposes.

Spoofing the timezone, the screen size and the font fingerprint is the most interesting cluster here, because those values are read by scripts through standard web APIs, and the extension can intercept some of those reads. Whether each one is intercepted in this implementation is not documented in the README, which is the gap to keep in mind.

## Whitelists, regular expressions and per rule profiles

The whitelist is the most interesting design decision in the project, and the one that has an external guide rather than README documentation.

The capability is: use your real or spoofed profile for whitelisted sites, with support for regular expressions, and a custom profile per whitelist rule with multiple sites per rule. So the model is not a single global setting. You can have a randomly spoofed browser everywhere except the sites where you have signed in, where the real profile is used, and you can even specify a different profile per rule, which covers the case where one site needs a specific configuration rather than your genuine one.

Regular expressions are what make this usable rather than merely possible. A list of exact hostnames would not work for a site with many subdomains or a CDN fronted domain, and a pattern per rule scales better than a growing list of domains.

The trade-off is that a regular expression that is too broad will silently apply to sites you did not intend, and the consequences are asymmetric. A spoofed profile on your bank or your identity provider is a worse outcome than a site detecting you as a returning visitor. The README points to a separate whitelist guide for the details, and the wiki is linked for people who do not know where to start, so the rules are documented, just not in the place you would look first.

## Building it: webpack, Vue 2 and a test script that builds first

The package scripts show how the extension is put together. The build is webpack with the legacy OpenSSL provider enabled through cross-env, which is the standard workaround for newer Node versions refusing the older hashing algorithms webpack 4 expects:

```json
  "scripts": {
    "lint": "eslint --ext .js,.vue src",
    "prettier": "prettier \"src/**/*.{js,vue}\"",
    "prettier:write": "npm run prettier -- --write",
    "build": "cross-env NODE_ENV=production NODE_OPTIONS=--openssl-legacy-provider webpack --hide-modules",
    "build:dev": "cross-env NODE_ENV=development NODE_OPTIONS=--openssl-legacy-provider webpack --hide-modules",
    "build-zip": "node scripts/build-zip.js",
    "test": "npm run build && npm run build-zip && jest --detectOpenHandles",
    "watch": "npm run build -- --watch",
    "watch:dev": "cross-env HMR=true NODE_OPTIONS=--openssl-legacy-provider npm run build:dev -- --watch"
  },
```

The point worth making is the test line: it builds the extension and packages a zip before running jest, so the tests exercise a built artefact rather than only the source.

The stack is Vue 2 with vuex for state, vue-i18n for translations, tailwindcss for styling and feather-icons for the icon set, with jest and ts-jest for the tests. There is a husky pre-commit hook running pretty-quick on staged files, an eslint config, a prettier config, a postcss config and a tailwind config at the root, alongside the src, scripts and tests directories and a CHANGELOG.md.

The interesting detail is the version pin. The dependency list still carries Vue 2 and tailwindcss 1.x, which means this is a codebase on the older generation of its UI stack, and the webpack build with the OpenSSL legacy flag is consistent with that. It builds, and it is consistent, but it is not a codebase that has been modernised.

## Install paths, translations and release naming

Installation comes in two flavours. Chameleon is available on the Firefox Add-ons website, and a developer build is also available on GitHub releases. That distinction matters for anyone evaluating it, because the add-on store build and the developer build are not necessarily the same artefact, and the release tags show that the project publishes both.

The release names are informative. The tags are v0.22.87 for a Chameleon Legacy Build and v0.22.87-rc for a Chameleon Dev build, with an earlier v0.22.86 legacy build. So the project tracks two lines, a legacy build and a development build, on the same version number, and the last push to the repository was on 2026-10-15 with the newest tag from 2026-09-02.

Translations run through Crowdin, and the credits section lists contributors for the Chinese, French, German, Japanese, Polish, Russian, Spanish, Turkish, Brazilian Portuguese, Portuguese, Finnish, Italian and Korean translations, which is a substantial localisation effort for a small extension.

Contributions are invited through pull requests and issues, with the same caveat about technical impossibility attached, and there is a wiki linked from the README for people who do not know where to start, plus a dedicated whitelist guide for the feature most likely to cause trouble if it is misconfigured. The GPL-3.0 licence is the one constraint to keep in mind for anyone considering modifying and redistributing the code.

## Conclusion

Adopt Chameleon if you want a single Firefox add-on that randomises your browser profile across requests and covers the fingerprinting surfaces beyond the user agent, and you are comfortable reading its whitelist rules. Do not adopt it if you need to change browser configuration itself, since the README states plainly that WebExtensions are unable to modify about:config entries, so anything implemented as a preference is out of reach. Verify first that the version you install matches the release notes for your browser, that the whitelist rules you write actually match the sites you intend, since the guide is separate from this README, and whether the fingerprint you are spoofing is one you actually want changed, since a random profile per request is not the same artefact as a stable one.

## FAQ

### What is Chameleon?

Chameleon is a WebExtension port of the Firefox add-on Random Agent Spoofer, with a near identical interface and most of the original features. It spoofs the user agent, several request headers and a range of fingerprinting surfaces, and adds a whitelist system with regular expressions.

### Which headers does Chameleon modify?

The headers options cover enabling Do Not Track, preventing Etag tracking, spoofing accept headers, spoofing the X-Forwarded-For and Via IP, disabling the referer and modifying referer policies. The user agent itself is set separately from a list of browser profiles.

### Can Chameleon change browser settings in about:config?

No. The README states that WebExtensions are unable to modify about:config entries, and the contribute section warns that some of the advertised functionality is not technically possible. Any option that depends on a browser preference rather than a web API is therefore outside what the extension can do.

### How does the Chameleon whitelist work?

You can use your real or spoofed profile for whitelisted sites, with regular expressions supported, and a custom profile per whitelist rule with multiple sites per rule. The details are in the separate whitelist guide linked from the README and the wiki.

## Sources

- [License: GPL-3.0](https://github.com/sereneblue/chameleon/blob/master/LICENSE)
- [Project website](https://sereneblue.github.io/chameleon)
- [README](https://github.com/sereneblue/chameleon/blob/master/README.md)
- [Releases](https://github.com/sereneblue/chameleon/releases)
- [sereneblue/chameleon on GitHub](https://github.com/sereneblue/chameleon)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/sereneblue-chameleon