CarlCloak Chrome extension security report

CarlCloak protects your browser identity by spoofing multiple fingerprinting vectors — from behavioral biometrics to static canvas/WebGL hashes and HTTP headers. 🛡️ WHAT IT DOES • Behavioral noise — adds Gaussian noise to mouse coordinates, keystroke timings, touch events, and scroll patterns so behavioral biometric systems cannot profile you • Canvas & WebGL spoofing — injects subtle pixel noise into toDataURL() and getImageData() calls; masks GPU vendor/renderer strings • Navigator & Screen spoofing — reports consistent fake platform, hardware concurrency, memory, and screen resolution • Audio fingerprint protection — adds noise to AudioBuffer processing • Font detection noise — randomizes measureText() output • HTTP header spoofing — replaces Accept-Language with your chosen locale at the network level (visible to server-side detectors like whoer.im, 2ip.io) • Timezone spoofing — overrides Intl.DateTimeFormat and getTimezoneOffset() plus HTTP headers simultaneously • Timer rounding — rounds Performance.now() and Date.now() to reduce timing-based fingerprinting • Gyroscope zeroing — reports zero values for DeviceOrientation/DeviceMotion events 🌍 QUICK PROFILES Switch your entire identity (timezone + language + HTTP headers) in one click: Polish · Kazakh · Japanese · Austrian · UK English · Russian · French · German · US English · Ukrainian · Czech · Spanish ⚙️ THREE PROTECTION MODES Off — no spoofing, full passthrough Spoof — adds realistic noise; pages work normally Block — drops behavioral event listeners entirely 🔒 PRIVACY FIRST • No data collection — zero telemetry, no analytics, no remote servers • All processing is local — your config stays in browser storage • Open architecture — content scripts run in MAIN world for reliable interception • Domain whitelist — exclude trusted sites (YouTube, Google accounts, Figma pre-added by default) • Works in Vivaldi, Brave, Opera and any Chromium-based browser 💡 USE CASES — Prevent cross-site behavioral tracking — Test how websites see your browser identity — Match your VPN's region with consistent language/timezone headers — Reduce fingerprinting surface without breaking sites