Camoufox is an open-source anti-detect browser built by recompiling Firefox from source, rather than patching a stock build after the fact.
What it is
Where a stealth plugin injects JavaScript to hide automation properties, Camoufox changes them at the C++ implementation level before the browser is even compiled. That covers navigator properties, WebGL and Canvas output, media capabilities, locale signals, and WebRTC's local IP exposure, plus scripted, human-like mouse movement. Modifying the source directly, instead of patching the running browser, avoids the small inconsistencies that JavaScript-level shims tend to leave behind, which is the same design choice patched-Chromium projects like nodriver make on the Chrome side.
How it gets used to scrape
Camoufox targets exactly the traffic that gets blocked by fingerprint-based anti-bot systems: scraping sites with aggressive JavaScript checks, and running many separate browser identities for multi-account or multi-profile workflows where each session needs a distinct, internally-consistent fingerprint.
Why it's hard to catch with old checks
A fingerprint check compares what the browser reports against a known automation signature. Camoufox is built to make every one of those values look like a real Firefox install, because the values come from the same C++ code path a real install uses, not from a script overwriting them afterward. That's a materially harder problem for a detector that only inspects the fingerprint surface. It doesn't change what the session does once it's rendering the page, which is where behavioral detection picks it up instead.
Centinel detects it
In our September 2026 benchmark, Centinel identified every Camoufox session we tested. Fingerprint-level spoofing at the C++ layer doesn't change how a session behaves across requests, and that's the layer Centinel evaluates alongside connection and request signals.
Key takeaways
- Camoufox patches Firefox at the C++ level before compilation, which makes its fingerprints more internally consistent than a JavaScript-level stealth shim.
- It's built for both anti-bot evasion and running many distinct browser identities at once.
- Behavioral signals across a session, not fingerprint checks, are what still separate it from a real visitor.