Skyfense
Feature / Script integrity

When the browser
lies, we check.

Bots now disguise themselves to look like a normal Chrome or Safari visitor. Skyfense inspects how the browser really behaves — and catches the tell-tale signs that fake and automated browsers leave behind.

Talk to the team ↗
Browser integrity check
  • navigator.webdriverhidden
  • Function.toStringpatched
  • WebGL rendererSwiftShader
  • $cdc_ artifactfound
ResultAutomation detected
What we check

Evidence from
inside the browser.

01

Native function integrity

Function self-integrity checks identify patched browser functions that claim to be native but have been modified by stealth plugins.

TOSTRING CHECK
02

Driver artifacts

Known ChromeDriver and Selenium DOM/window artifacts such as $cdc_*, __webdriver_evaluate, and domAutomationController are scanned directly.

ARTIFACT SCAN
03

Headless rendering

WebGL renderer strings including SwiftShader, llvmpipe, and software ANGLE reveal the software-GPU environments common in headless browser farms.

WEBGL CHECK
04

Environment consistency

User-agent claims are compared with rendering engines, media devices, permissions, keyboard APIs, and user-activation behavior to catch spoofing.

CROSS-CHECK
Avoid false positives

Incognito is not
an attack.

Private browsing legitimately restricts APIs such as plugins, Chrome runtime, permissions, and proof-of-work behavior. Skyfense neutralizes or discounts those noisy signals.

Strong evidence still matters: clear automation artifacts, patched natives, or multiple strong signals can produce a block.

See bot protection ↗