WebGPU: The New Antifraud Tool Already Changing the Game

Just a few years ago, discussions of browser fingerprinting boiled down to a familiar set of criteria: Canvas, WebGL, AudioContext, and dozens of other fingerprints used by a website to identify a device. Today, this list is rapidly becoming outdated. WebGPU, a new graphics API that gives web applications near-direct access to the computing power of a video card, is coming to the forefront. And it's around this API that a new generation of methods is being built to distinguish a live user from a virtual machine, VPS, remote server, or anti-detection browser.

Let's explore why a technology designed for gaming and 3D graphics has become the focus of anti-fraud experts—and why traditional fingerprint substitution methods no longer work against it.

Why WebGL is giving way

For many years, WebGL was the primary bridge between the browser and graphics. It allowed a website to determine the graphics card model, capture a graphical fingerprint of the device, run a series of visual tests, and use the results for identification. The problem is that WebGL's development has effectively stalled: the Khronos Group, the organization behind the standard, has explicitly stated that it no longer intends to actively develop the technology. The API architecture is outdated, and its capabilities are no longer sufficient for the needs of the modern web.

WebGL is being replaced by WebGPU. Putting aside the technical details, the essence is simple: it allows the browser to work with the graphics card almost as efficiently as full-fledged desktop applications. This means much faster and deeper access to the GPU itself, video memory, computing cores, and modern graphics capabilities. Hence WebGPU's reputation as one of the key technologies of the future of the web.

Not just for developers

The possibilities opened up by WebGPU are impressive. Browser-based AAA games, professional 3D graphics, image processing, machine learning right in the tab, and full GPU utilization without installing native software—all of this is becoming a reality. But there's a downside.

According to Dmitry Momot, this same level of access can be used for malicious purposes: to run heavy calculations on someone else's hardware, execute malicious code, conduct GPU-based attacks, or simply exploit the user's computing resources. Therefore, WebGPU is of interest not only to browser and game developers, but also to those involved in security—on both sides of the fence.

What the site actually sees—and why it's not enough

This is where things get interesting. Chrome developers have significantly limited the amount of data WebGPU provides to websites. While it was previously possible to extract fairly detailed information about a video card, today a website is essentially limited to three things: WebGPU support, the GPU manufacturer, and the device architecture. The browser is already hiding detailed hardware identifiers. It would seem that classic fingerprinting has been dealt a blow, but this doesn't solve the problem at all.

The webinar's main point comes as a surprise: antifraud software is largely uninterested in WebGPU support itself. Many believe that if a site checks for WebGPU support, it's the one that identifies the virtual machine. In practice, the "WebGPU Supported" flag means almost nothing. It can be enabled manually, changed in browser settings, emulated, or spoofed in a dozen ways—meaning, as a standalone indicator, it's practically useless.

Moreover, the naive logic of "no WebGPU means it's a virtual machine" leads to numerous false positives. An old graphics card may not support DirectX 12; the browser automatically disables WebGPU on unsupported hardware; much depends on the driver and the specific GPU model. As a result, an ordinary user with an old computer can easily be labeled as the owner of a virtual machine. Some popular fingerprint verification services do exactly this—and that's why their verdicts cannot be considered reliable.

So what actually determines whether WebGPU is available? According to the webinar, the browser makes its decision based on several factors: DirectX 12 support, the WDDM driver model version, the capabilities of the graphics card itself, and Chrome's internal policies. This is why the same browser version can behave completely differently on two different machines. And since support itself is so easily spoofed—via the Windows registry, by spoofing browser properties, by editing JavaScript API responses, or by special tools—modern anti-fraud systems have long since stopped relying on it.

Real power is in the benchmark

If a WebGPU costs next to nothing, then where does its value lie for antifraud? The answer lies in its performance benchmark. A WebGPU allows for truly intensive calculations to be run directly on the user's graphics card, and during this test, the processing speed, actual GPU performance, and the specifics of its architecture can be measured. The result of these calculations becomes a new, much more reliable fingerprint.

The difference with WebGL is fundamental. It could also run graphics tests, but the differences between modern graphics cards were blurred and barely noticeable. WebGPU has much deeper access to GPU resources, so performance assessments are significantly more accurate. According to the webinar's author, the accumulated statistics are already sufficient to confidently distinguish between different generations of graphics cards. This is precisely what makes the technology such an attractive tool.

A well-implemented WebGPU benchmark reveals a wide range of inconsistencies: the use of anti-detection browsers, VPS, remote desktops, and dedicated servers, and, most importantly, the discrepancy between the advertised graphics card and its actual performance. Imagine: the browser reports that the system has an RTX 4090, but the computing power matches that of the integrated Intel Graphics. This discrepancy is immediately apparent.

This leads to an important conclusion for those trying to mask their surroundings. Previously, it was enough to replace the GPU name string, and the fingerprint would look convincing. Now, that's not enough. If the browser declares one model, but the performance reveals a completely different architecture, this creates the very contradiction that anti-fraud software values ​​most. Simply replacing the GPU model no longer works.

Can you tell when you're being checked?

A logical question arises: is it possible to tell if a website is running a WebGPU benchmark at this point? According to Dmitry Momot, yes, and there are two main approaches.

The first is to monitor the graphics card load. A heavy benchmark places a noticeable load on the GPU, and this is especially noticeable on weak integrated chips: as soon as you open the graphics card load monitor, characteristic spikes in activity appear on the graph. Lighter tests, on the other hand, can run almost without a trace.

The second approach is to look at the page's code. A JavaScript call to navigator.gpu is a strong indicator that the WebGPU is in use. However, it's important to be aware of obfuscation here: the code can easily be obfuscated to hide such calls.

Hence the practical advice from the webinar, which at first sounds paradoxical. Even a very demanding test can pass almost unnoticed on a powerful RTX 4090, while modest integrated graphics respond much more dramatically to the load. Therefore, when analyzing the performance of websites using WebGPU benchmarks, weaker hardware is sometimes more convenient than high-end hardware.

What does it mean

WebGPU is rapidly becoming one of the most interesting data sources for modern anti-fraud systems. But the key lesson is this: it's not the technology itself that's valuable, but the hardware's behavior. The support flag itself means next to nothing and is easily emulated—the real power comes from the ability to run powerful calculations and compare the device's stated specifications with its real-world behavior.

This shift opens up new ways to detect anti-detection browsers, fake GPU fingerprints, virtual machines, VPS, and remote servers, as well as any discrepancies between declared and actual hardware performance. And the more widespread WebGPU becomes, the more obvious the overall trend becomes: the device's computing characteristics are becoming more important than the User Agent string or a fancy graphics card name.

For information security specialists, this represents a paradigm shift—a gradual transition from analyzing static fingerprints to analyzing the actual behavior of hardware. And, apparently, this is just the beginning.