Seventy-three Chromium patches sit behind a familiar browser API
CloakBrowser keeps the Playwright or Puppeteer programming model and changes the browser underneath it. The README says its Chromium build carries 73 source patches for canvas, WebGL, audio, fonts, screen properties, WebRTC, network timing, CDP input, and other fingerprint signals. Python users can replace the Playwright startup calls with launch(), while JavaScript users get Playwright and Puppeteer entry points. A community-maintained .NET client covers a third ecosystem.
The repository itself is fairly compact for a browser product: our checkout contained 225 files, about 66,642 lines of source, and 8.1 MB before dependencies. That is possible because the custom Chromium binary is downloaded rather than built from this wrapper checkout. First launch retrieves roughly 200 MB and caches it. The code you audit here controls downloads, options, and API behavior; it is not the complete browser source tree represented by the packaged binary.
The newest Chromium build requires a key and limits free concurrency
The repository declares an MIT license, yet current browser access has a separate commercial shape. The README says the latest build is free after GitHub sign-in for one concurrent session. Paid plans raise the concurrent-session limit and provide the current Pro binary, while the older Chromium 146 build remains on GitHub Releases. Teams choosing this project should assess the wrapper license and binary terms separately.
Release chromium-v151.0.7922.108.3-pro arrived on August 27, 2026 for Linux x64, Linux ARM64, Windows x64, and both macOS architectures. The wrapper selects a build using a license key, and the release documents environment-variable pins for rollback. Pinning matters because a new fingerprint seed can resolve to a different hardware identity across builds. Persistent identities therefore need coordinated handling of the browser version, seed, profile, and proxy address.
What happened when we ran it
Our sandbox installed commit f04c23d in 49 seconds, adding 47 Python packages and occupying 191 MB. The build completed in 12 seconds. We used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, and no secrets. Those first two stages were clean, and pip-audit reported 0 known vulnerabilities in the installed packages.
The test command failed after 639 seconds. Pytest reported 742 passed, 54 failed, 2 skipped, and 15 collection or setup errors out of 811. Its final timing line was 627.44 seconds. That is a lot of working code, but a red suite with 69 failures or errors is not a release check we would waive for a browser intended to behave consistently across sites and platforms.
The supplied log tail shows many TargetClosedError exceptions while launching or using the browser. Another test raised an ImportError saying geoip2 is required for geoip=True and gave an installation instruction. The log does not establish why the browser targets closed, so we will not blame container permissions, missing system packages, or the binary. The checkout had 3 CI workflow files, a Dockerfile, and a tests directory.
Detection results depend on the site, proxy, and browser build
CloakBrowser makes unusually broad claims. The README says it has been checked on more than 30 detection sites and presents results for Cloudflare Turnstile, reCAPTCHA, FingerprintJS, BrowserScan, and other services. It also says the tool does not solve CAPTCHAs. Instead, the patched browser tries to avoid the signals that cause a challenge. That distinction matters because the final decision belongs to a remote system the project does not control.
Current issue reports show the limit. Issue 528 describes Akamai blocking both free and Pro configurations while plain Chrome sometimes worked for the reporter. Issue 526 says a current Windows build was flagged by DataDome and BrowserScan. Issue 503 says the older free binary rarely passed one Cloudflare flow for its reporter. These reports do not disprove every README test; they show that a green vendor matrix cannot predict a particular account, proxy, region, or target.
Humanized input and GeoIP matching add their own dependencies
Setting humanize=True changes mouse paths, typing delays, scrolling, and element interaction. Proxy-aware GeoIP can match timezone and locale to an exit address, and the browser can alter the WebRTC address it exposes. Persistent contexts retain cookies and local storage. These controls address several common inconsistencies, but they also create state that an operator has to own and test. A random fingerprint on every login can be as suspicious as a visible automation flag.
Our 47-package environment also exposed one optional-extra boundary: a test using geoip=True failed because geoip2 was unavailable. The README documents a cloakbrowser[geoip] install for that path and notes that it makes external IP-resolution calls through the proxy. Protected-site examples recommend a residential proxy and headed mode, while proxy rotation and CAPTCHA solving remain outside the package. Budget for those services and for the display resources needed by headed sessions.
August releases and September reports show fast, unsettled work
GitHub recorded the last push on August 30, 2026, three days after the latest Pro browser release. An open pricing and free-version discussion was updated on September 2, while a closed WebRTC issue received later activity on September 1. The repository had 31,128 stars, 188 open issues excluding pull requests, and 211 combined issues and pull requests when fetched. That is an active project with a busy support surface.
The 742 passing tests show there is real engineering under the marketing, while 54 failures and 15 errors keep this version out of the set-and-forget category. Trial the exact build, operating system, mode, proxy type, and authorized destination you will use. Keep a rollback pin, record success rates outside the vendor's demo list, and decide whether the current-binary subscription is acceptable before making CloakBrowser central to a job.