FingerprintJS proved installed apps can identify users across every major browser

Privacy features in browsers treat identity as browser state: cookies, canvas fingerprints and audio fingerprints are cleared, randomized or blocked by incognito mode, a VPN or Tor, so switching browsers looks like a fresh start. FingerprintJS researchers attacked the signal that stays behind: the applications installed on a machine do not change when a person changes browsers or hides behind a VPN, so the app set can link the same person across Chrome, Firefox, Safari and Tor on that computer.

Deep linking is the channel. Desktop browsers hand custom URL schemes such as skype:// to whichever installed application registered them, and they ask the user before launching. A page can therefore test an app's presence: navigate to its scheme and watch how the browser reacts. Probing 32 popular applications and combining the yes/no answers yields a 32-bit identifier in seconds, on Windows, macOS and Linux.

Each browser leaked the same answer through a different weakness. Chrome required a user gesture, but an extension such as its PDF viewer reset the protection flag; Firefox showed an internal error page for unknown schemes, making an installed app's popup detectable; Safari had no scheme-flood protection; and Tor, which disables confirmation dialogs entirely, ran the probes invisibly in iframes.

The move was disclosure rather than exploitation. FingerprintJS published the technique with a working demo, released the source code and filed bug reports with all four browser vendors, stating that it does not use the vulnerability in its own products. Mozilla's Bugzilla opened issue 1711084, and Tor Browser later attached a patch; the Hacker News announcement on 13 May 2021 drew 467 points and 200 comments, with readers running the demo as a field test.

Probe installed apps through URL-scheme dialogs to build an ID no privacy mode resets

Installed applications are device-level state, so an identifier built from them survives incognito, VPNs, browser switches and Tor in a way no cookie or canvas fingerprint can.

Custom URL schemes expose app presence without permission: a browser offers to launch a scheme only when a real application registered it, and JavaScript can observe whether that offer happened.

The attack used only popup windows, iframes and same-origin rules that already existed, so every major desktop browser exposed the signal in some form, with no plugin or OS access needed.

Tor's privacy choice to disable confirmation dialogs backfired: with nothing visible to the user, the probes ran invisibly in iframes, turning the most private browser into the quietest leak.

Shipping a demo and opening bug reports let outsiders reproduce the finding, turning a vendor's private claim into tracked issues, a browser patch and public scrutiny.

Installed apps are device-level state that survives incognito, VPNs and browser switches; any observable UI difference, even whether a dialog appears, becomes a tracking signal.

Mozilla tracked the report as bug 1711084 and Tor Browser attached a patch developed by Matthew Finkel; years later the bug was still open. The article's August 2022 update reported Chrome's and Firefox's tracker entries as still open and unresolved. The demo and source repository stayed live, and the article kept its disclaimer that FingerprintJS does not use the vulnerability in its own products. The Hacker News thread on 13 May 2021 drew 467 points and 200 comments; readers ran the demo as a field test, some confirming matching identifiers across browsers, others reporting false positives.