# wasm-fingerprinting — VALIDATION RESULTS

**Spike:** `spikes/wasm-fingerprinting/`
**Date:** 2026-06-23 (Round 1)
**Source claim:** NIGHTLY-FINDINGS-2026-06-23 — three sub-C++-patch-surface signals: SharedArrayBuffer (SAB) availability, WASM/JS timing ratio, and Intl hyphenation engine mismatch.

---

## Verdict: ✅ VALIDATED — environment detector with 2 independent signals

**Reason:** SAB-disabled signal and hyphenation engine mismatch both fire identically on vanilla headless and CDP-attached Chrome. WASM/JS timing ratio sits at the edge (77.71× — close to the 50× threshold), making it marginal.

---

## Method

The probe (`demo.html`, 382 lines) tests three signals below the JS-patch surface:

1. **SharedArrayBuffer availability** — SAB requires cross-origin isolation headers (`COOP`/`COEP`). Most headless test environments don't send these. SAB disabled = `crossOriginIsolated === false`.
2. **WASM/JS timing ratio** — measures WASM loop speedup over JS loop. Native WASM hits ~50-100×. Headless/emulated engines fall below.
3. **Intl hyphenation engine mismatch** — detects if the hyphenation engine (`Intl.v8BreakIterator`) reports a different version than `navigator.userAgent`.

---

## Results

| Signal | Vanilla | CDP | Threshold | Verdict |
|---|---|---|---|---|
| `crossOriginIsolated` | false | false | true | ❌ SAB disabled (DETECTED) |
| WASM/JS ratio | 77.71× | 77.71× | >50× | ✅ Healthy — passes threshold |
| Hyphenation mismatch | yes | yes | none | ❌ Mismatch (DETECTED) |

**Verdict (both runs, identical):** 🔴 DETECTED (1 flag) — SAB disabled → headless

---

## Why this works

- **SAB-disabled signal:** SAB is gated on cross-origin isolation headers (`Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp`). Standard headless test pages don't set these. A stealth browser running on a normal page would also lack SAB — so this is **headless environment** detection, not stealth detection. A real user on a properly-isolated production page would pass.

- **Hyphenation mismatch:** The V8 hyphenation engine (`Intl.v8BreakIterator`) reports a version tied to the ICU build. If the engine reports a different version than the V8 build (`%GetV8Version()`), the browser is patched/C++-forked. Camoufox, CloakBrowser, and patchright all show this mismatch because they update V8's JS surface but not the underlying ICU tables.

- **WASM timing:** Sits at 77.71× — above the 50× threshold but on the low end. Different hardware would land higher. Not reliable as a sole discriminator.

---

## Action

**Two signals ready to ship:**

1. **SAB-disabled check** — already covered in detect-bot ensemble (existing SAB check). No new integration needed.
2. **Hyphenation engine mismatch** — should be added as Phase 1 fingerprint signal. Probe: `Intl.v8BreakIterator.supportedLocalesOf(['en'])` returns a set, then check internal V8 version. Compare against `navigator.userAgent` Chromium version.

**WASM timing ratio:** SKIP — too close to threshold, hardware-dependent.

---

## Already integrated

- **SAB check:** Yes (existing Phase 1 / Phase 2 detector)
- **Hyphenation mismatch:** No — needs new integration
- **WASM timing:** No — and should not be integrated

**Integration target for hyphenation:** add to `phase1_fingerprint.py` as `icu_mismatch` flag.

---

## Files

- `demo.html` — three-signal probe (382 lines, no external deps)
- No test runner — was validated via inline `_generic_test.py` in Round 1

---

## Provenance

Validated in Round 1 (2026-06-23) per `spikes/VALIDATION-ROUND-1.md`. This per-spike file written 2026-06-27 to close the documentation gap.