Chromium 148: Math.tanh now targets your operating system

A tiny numerical regression opens a cross-browser fingerprinting path. In crypto as in tracking, there is no such thing as chance.

The fact

Since Chromium 148, Math.tanh returns low-order bits that vary depending on the underlying OS (macOS, Linux, Windows). Scrapfly published a writeup on July 12, 2026, showing that the OS can be reconstructed with a few calls - an exploitable fingerprinting vector without permission.

Our analysis

This is not a spectacular bug, it's the demonstration that any mathematical libc is a side-channel. TC39 has tolerated differences in the last bit on transcendental functions to allow optimizations to play. The price: every divergence becomes a signal.

Under the hood

Math.tanh(x) ultimately relies on the OS's libm (glibc, Apple's libm, msvcr). These implementations comply with IEEE 754 on the visible result, but differ on the final ULP bits. Chromium 148 changed its internal fallback: the values returned betray the underlying libm. Count ~5-10 calls to disambiguate the three major OSes with >95% confidence.

So what

Don't patch Math.tanh - patch your threat model. Fingerprinting via numerical divergences will spread (Math.log, Math.pow…). The real protections are on the browser side: Firefox and Brave already normalize some results. Combined with canvas, WebGL, and audio, the signal increases the precision.

To watch

A Chromium patch normalizing tanh; the same technique on other transcendental functions; integration into commercial anti-bot libraries.