CloakBrowser: Stealth Chromium Passes All Bot Detection

CloakBrowser is trending #2 on GitHub today with 1,325 stars gained—a stealth Chromium browser that passes every major bot detection test by patching fingerprints at the C++ source level instead of injecting JavaScript. Launched recently and tested in April 2026, it scores 0.9 on reCAPTCHA v3 (versus 0.1 for stock Playwright), passes Cloudflare Turnstile, and works as a drop-in Playwright/Puppeteer replacement. While commercial anti-detect browsers charge $49-299/month for similar capabilities, CloakBrowser is free and open-source.

JavaScript injection is dead. This is the new playbook.

Why Traditional Bot Detection Evasion Fails

Traditional tools like playwright-stealth and undetected-chromedriver inject JavaScript or tweak config flags at runtime. Anti-bot systems have evolved to detect these patches themselves. Cloudflare has studied undetected-chromedriver extensively and built countermeasures. playwright-stealth scores 0.3-0.5 on reCAPTCHA v3—better than stock Playwright’s 0.1, but nowhere near human-like behavior.

CloakBrowser solves this by modifying Chromium at the C++ source level before compilation. Detection systems see a real browser because it is a real browser. The binary contains 49 patches targeting Canvas rendering, WebGL, Audio fingerprinting, Font detection, GPU reporting, WebRTC behavior, and automation signal removal—all compiled into the Chromium engine at the C++ level.

When a detection system checks navigator.webdriver, it gets false (source patch, not runtime override). Check navigator.plugins.length? It returns 5 real plugins, not the telltale 0 of headless browsers. User Agent says “Chrome/146.0.0.0” with no “HeadlessChrome” leak. This isn’t clever JavaScript trickery that breaks with the next Chrome update—it’s fundamental engine-level modification.

Test Results Prove Source-Level Approach

CloakBrowser passed 30+ detection services in April 2026 testing. reCAPTCHA v3 scores it 0.9 (human-like) versus 0.1 for stock Playwright—a 9x improvement. Cloudflare Turnstile, which fails stock Playwright entirely, auto-resolves with CloakBrowser. FingerprintJS reports normal browser behavior. BrowserScan gives it “NORMAL (4/4)” across all checks.

The performance gap between source-level patches and JavaScript injection is stark. playwright-stealth manages 0.3-0.5 on reCAPTCHA v3. undetected-chromedriver hits 0.3-0.7 depending on configuration and sometimes passes Cloudflare. In contrast, CloakBrowser consistently scores 0.9 and passes every major detection system.

Source-level modification survives Chrome updates. JavaScript injection tools break with every release, requiring constant maintenance. Config patches get detected as anti-bot vendors study popular libraries. C++ patches compiled into binaries are fundamentally harder to identify because they’re indistinguishable from genuine browser behavior.

Drop-in Playwright Replacement with Humanization

CloakBrowser implements the Playwright and Puppeteer APIs natively—no new abstractions. Install via pip install cloakbrowser or npm install cloakbrowser playwright-core. The binary (~200MB) downloads automatically and caches locally.

Basic usage looks identical to stock Playwright:

from cloakbrowser import launch

browser = launch(
    proxy="http://user:pass@proxy:8080",
    humanize=True,
    geoip=True
)
page = browser.new_page()
page.goto("https://protected-site.com")

The humanize=True flag adds Bézier curve mouse movements, natural keyboard timing with thinking pauses, and realistic scroll physics with one line of code. Combined with proxy support and automatic timezone/locale detection via geoip=True, this covers the behavioral analysis layer that sophisticated detection systems use alongside fingerprinting.

Migration from Playwright or Puppeteer requires changing one import statement. The API surface remains identical—existing automation scripts work without modification.

Free Alternative Challenges Commercial Market

Commercial anti-detect browsers charge substantial subscription fees: GoLogin starts at $10/month for 50 profiles, Kameleo runs $59-149/month, Multilogin charges $29-199/month. These tools provide enterprise-level stealth with GUI-based profile management and support teams.

CloakBrowser offers enterprise-level test results at zero cost. The wrapper is MIT-licensed. The custom Chromium binary uses a proprietary CloakBrowser License but remains free to use. This pricing model directly challenges the commercial anti-detect browser market, particularly for developers who need effective bot detection evasion without enterprise budgets.

The trade-off: commercial tools provide GUIs, browser profile management interfaces, and customer support. CloakBrowser is code-first, community-supported, and requires trust in CloakHQ’s custom binary (though SHA-256 checksums verify integrity). For developers comfortable with Playwright or Puppeteer APIs, the savings are substantial.

Use Cases and Legal Boundaries

Legitimate use cases exist: automated testing on production sites with bot protection, accessibility testing, research projects analyzing publicly available data, and web scraping for price monitoring or competitive analysis.

However, bypassing bot detection doesn’t make scraping legal. GDPR applies to personal data regardless of whether it’s publicly visible. India’s DPDP Act and California’s CCPA create similar obligations. Respect robots.txt files and Terms of Service even when technically possible to bypass them—the Meta v. Bright Data (2024) precedent established that scraping public data while logged out doesn’t automatically trigger Terms of Service, but deliberate circumvention of access controls invites legal risk.

CloakBrowser’s documentation explicitly states it “doesn’t solve CAPTCHAs—it prevents them from appearing.” This is an important distinction. The tool minimizes detection friction for legitimate automation, not credential stuffing or DDoS attacks.

Limitations to Consider

CloakBrowser requires integration with third-party CAPTCHA solving services as a fallback when prevention fails. No built-in proxy rotation—users provide and manage their own proxy infrastructure. The ~200MB binary requires local storage and trust in CloakHQ’s build process (mitigated by checksum verification).

Active maintenance matters for stealth tools. CloakBrowser’s last update hit in March 2026 with Chromium 145/146, showing ongoing development. Source-level approaches are more stable than JavaScript injection, but the arms race between automation and detection continues. Therefore, expect periodic updates as detection systems evolve.

Key Takeaways

• CloakBrowser passes 30+ bot detection tests via 49 C++ source-level patches compiled into Chromium binary
• reCAPTCHA v3 scores 0.9 (human-like) versus 0.1 for stock Playwright, passes Cloudflare Turnstile consistently
• Drop-in Playwright/Puppeteer replacement with humanize=True flag for natural behavior, minimal code changes
• Free and open-source alternative to $49-299/month commercial anti-detect browsers
• Legitimate use cases include automated testing, research, and accessibility testing—but legal boundaries still apply (GDPR, DPDP, CCPA)
• Source-level patches survive Chrome updates unlike JavaScript injection tools that break with each release

Check out CloakBrowser on GitHub—it’s trending for a reason.