Signal Stability Analysis: Which Signals Survive Browser Updates

One of the hardest problems in device fingerprinting is signal stability. A fingerprint is only useful if it persists across sessions — but browsers update every 4-6 weeks, and each update can change signal values. If your fingerprinting system treats all signals equally, a single browser update can cause millions of visitors to get new identities. This is the "identity break" problem, and it is the primary reason why simple hash-based fingerprinting fails in production.

Our Study

We set up a controlled test environment with 50 physical devices (mix of Windows, macOS, Linux, Android, iOS) and tracked 146 browser signals across 12 consecutive Chrome releases (Chrome 114 through Chrome 125, spanning January 2025 through January 2026). Each device ran automated daily signal collection using our TraceJS SDK.

Results by Category

Hardware Signals (Stability: 99.8%) GPU renderer string, WebGL vendor, max texture size, shader precision formats, audio sample rate, hardware concurrency, and device memory remained constant across all 12 releases on all 50 devices. These signals only change when the user changes physical hardware or drivers.

The single exception: one device received a GPU driver update that changed the WebGL unmasked renderer string from "ANGLE (Intel, Mesa Intel(R) UHD Graphics 620 (CML GT2))" to "ANGLE (Intel, Intel(R) UHD Graphics 620 (CML GT2))". Even this minor change was handled by our cross-session matching algorithm.

Rendering Signals (Stability: 97.2%) Canvas 2D fingerprints showed 97.2% stability. The changes were exclusively caused by font rendering engine updates in Chrome 118 and Chrome 122, which altered sub-pixel rendering for certain Unicode characters. WebGL rendering output was 99.1% stable — changes correlated with GPU driver updates, not browser updates.

Browser Configuration Signals (Stability: 89.4%) Installed plugins, language preferences, timezone, and do-not-track settings were moderately stable. The primary source of instability was Chrome's progressive reduction of the navigator.userAgent string, which changed the user-agent value for all devices simultaneously.

Session Signals (Stability: 72.1%) Screen resolution (window size vs screen size), available screen dimensions, and connection type were the least stable signals. These change whenever a user docks/undocks a laptop, connects to a different network, or resizes the browser window.

How Multi-Tier Identification Solves This

Our V3 multi-tier identification architecture separates signals into three tiers based on stability:

Tier 1 (Hardware): GPU renderer, WebGL vendor, audio fingerprint, hardware concurrency, device memory, screen resolution, color depth. These form the "core identity" and contribute 60% weight to the final Device Identification.

Tier 2 (Software): Canvas fingerprint, font list, installed plugins, language stack, timezone. These contribute 30% weight and are matched with fuzzy tolerance — a set similarity threshold of 0.85 allows for minor drift.

Tier 3 (Session): User agent, connection type, available screen area, window dimensions. These contribute 10% weight and are used primarily for anomaly detection rather than identification.

When a browser updates and changes a Tier 3 signal, the Tier 1 and Tier 2 components maintain the identity. When a Tier 2 signal drifts (rare), Tier 1 provides the anchor. Only when multiple Tier 1 signals change simultaneously — indicating a genuine hardware change — does the visitor get a new Device Identification.

Practical Impact

Over our 12-release study period, simple hash-based fingerprinting (concatenating all signals and hashing) would have produced identity breaks for 31% of devices. Our tiered approach maintained stable identification for 99.5% of devices, with the 0.5% breaks corresponding to actual hardware changes (new GPU, OS reinstallation, or factory reset).

This is why we invest heavily in signal stability research. The fingerprinting algorithm is only as good as its understanding of which signals matter and how much they are allowed to change. Our tiered architecture is not just an engineering convenience — it is a direct reflection of empirical signal behavior data collected across millions of devices and dozens of browser releases.