Protecting User Actions and Physical Devices

Protecting selection requires more than overriding one CSS property. Blink can reject selection because of computed style, inertness, a canceled pointer event, or a canceled selectstart event.

The fork hooks all of those decision points:

sequenceDiagram
  participant U as User
  participant I as Blink input dispatch
  participant P as Page handler
  participant S as Native selection
  U->>I: Mouse/touch press
  I->>P: pointerdown / mousedown / selectstart
  P-->>I: preventDefault()
  I->>S: Continue protected selection
  S-->>U: Rendered DOM text selected

The page-visible event remains canceled. The bypass is narrowly in the browser’s decision to continue the user-requested selection.

This applies to rendered DOM text. It is not OCR. Text painted into a canvas, image, video frame, WebGL surface, or plugin remains pixels unless another feature exposes its underlying data.

The clipboard design separates a trusted user-agent operation from script’s view of clipboard data.

flowchart TD
  Shortcut[Trusted copy/cut/paste shortcut] --> Snapshot[Protect target and selection]
  Snapshot --> OS[Browser-owned system clipboard operation]
  Snapshot --> DOM[Dispatch page-visible clipboard event]
  DOM --> Isolated[Isolated DataTransfer payload]
  Script[navigator.clipboard calls] --> Virtual[Page-facing virtual clipboard]
  Virtual -. no direct write .-> OS

The relevant hooks are split intentionally:

• ClipboardCommands handles editor commands and dispatches isolated clipboard events.
• KeyboardEventManager orders the trusted native action around page keyboard dispatch.
• Clipboard implements a private buffer for navigator.clipboard reads and writes.

In hardened mode, a script-initiated execCommand("copy") or execCommand("cut") can receive a successful, writable event payload without being allowed to replace the user’s system clipboard. navigator.clipboard remains present on secure pages, but its reads and writes resolve against the page-facing buffer. Clipboard-change observation is not wired to OS changes.

For a trusted shortcut, the real selection is protected before page keyboard handlers run. The page can cancel or mutate its isolated event and observe that behavior, but it does not replace the browser-owned system operation.

This is deliberately not stock Clipboard behavior. It can break collaborative editors, password managers implemented as web apps, and sites that genuinely need to exchange clipboard data with native applications. The existence and lifetime of the virtual buffer may also be distinguishable.

The Media Capture and Streams specification defines getUserMedia(), media constraints, tracks, and device enumeration. It also recognizes device lists, identifiers, labels, groups, and capabilities as fingerprinting surfaces. After permission or active capture, a site can normally learn much more about attached hardware.

Hardened Chromium keeps the permission decision but changes source selection and post-permission exposure.

sequenceDiagram
  participant W as Website
  participant P as Chrome permission UI
  participant R as Exact-origin/profile policy
  participant M as Content MediaDevicesManager
  participant F as Composite capture factory
  participant D as Real or private device
  W->>P: getUserMedia(constraints)
  P->>R: Resolve camera/microphone source
  P-->>W: User still chooses Allow or Block
  P->>M: Allowed request + source preference
  M->>F: Selected descriptor
  F->>D: Open platform, OBS, loop, or synthetic source
  D-->>W: MediaStreamTrack

The Geolocation specification treats location as a permission-controlled capability. In stock Chromium, an allowed request can reach the platform location provider.

hardened_privacy_source.cc adds per-WebContents source state and a process-wide rules cache. File I/O runs away from the browser’s critical thread. Callers use an immutable snapshot that refreshes on a short interval.

The cache fails private during a file transition: if the configured rules path changes and the matching snapshot is not ready, the lookup returns the fake choice rather than accidentally consulting stale rules from another profile. An exact-origin entry wins over the profile default.

GeolocationServiceImpl then routes an allowed request to the configured fake coordinates or the real provider. Permission and source selection remain separate decisions.

The project tests selection across CSS, inertness, mouse/touch cancellation, and selectstart; clipboard separation and command behavior; context-menu and input defaults; media enumeration and factory routing; source selectors; and location policy. The manual hardened-mode page requests camera, microphone, both independently, and location while reporting the values visible to script.

Important limits remain:

• virtual sources are not indistinguishable from physical devices;
• media contents and capabilities remain analyzable;
• a site may recognize generic labels or a one-device inventory;
• permissions, secure-context requirements, and OS failures still apply;
• the virtual clipboard intentionally breaks some legitimate integrations; and
• protected selection covers DOM text, not pixels.

The implementation protects particular user actions and reduces direct device exposure. It does not establish a universal anti-fingerprinting identity.

← Previous: Changing What a Website Can Observe · Next: Website View, Automation Signals, and the Shared Browser →