PathDriver and patch tooling

Step 2 of 7

What Is puppeteer-extra-plugin-stealth?

Pim · Scrappey Research

June 15, 2026 3 min read

Paste into ChatGPT, Claude, or any LLM

What Is puppeteer-extra-plugin-stealth? - conceptual illustration

On this page

puppeteer-extra-plugin-stealth is an open-source plugin for the puppeteer-extra wrapper that bundles a collection of independent "evasion modules." Each module patches a specific JavaScript-observable property of the browser environment so that a Puppeteer-controlled Chromium presents values closer to an ordinary user's browser - removing navigator.webdriver, rewriting the HeadlessChrome user-agent token, normalising plugins and WebGL vendor strings, and more. It operates entirely at the in-page JavaScript layer, and there is a parallel playwright-extra ecosystem. It is MIT-licensed.

Type	Plugin for puppeteer-extra (playwright-extra equivalent exists)
Mechanism	Modular JavaScript-surface evasions, applied per page
Patches	navigator.webdriver, UA token, plugins, WebGL vendor, etc.
License	MIT
Limitation	JS surface only - no TLS, IP, or real WebGL/renderer fix

How the stealth plugin works

The plugin is modular: each evasion is a separate module applied to every new page. Documented modules include one that normalises navigator.webdriver (newer versions return undefined via a Proxy to match a real browser, and add a launch flag that disables the automation-controlled blink feature), a user-agent override that rewrites the HeadlessChrome token out of the UA and aligns related headers, and patches to navigator.plugins, navigator.vendor, webgl.vendor, media codecs, chrome.runtime, and iframe and window properties. All of these work by injecting or patching JavaScript in the page context, fixing the surface that plain Puppeteer leaves with obvious headless markers.

Why JavaScript-only is not enough anymore

The plugin's defining limitation is that it patches only the JavaScript surface. It does not modify network-layer signals - the TLS fingerprint, IP reputation, or HTTP/2 fingerprint - and it cannot fix the deeper graphics tell: headless Chromium typically renders through a software renderer, so the real WebGL characteristics remain a SwiftShader-style tell that a JavaScript webgl.vendor override cannot fully mask. The plugin's own documentation frames detection as a cat-and-mouse game and acknowledges that preventing all of it is probably impossible. Against modern detection stacks, JavaScript-only evasions are widely considered insufficient on their own.

Maintenance status

puppeteer-extra-plugin-stealth is mature but effectively stale. Its last meaningful release is some years old and the repository's activity has slowed, so a number of its individual evasions are outdated relative to current Chrome versions and current detection techniques. It remains widely referenced and is a useful illustration of which JavaScript markers headless automation exposes, but it should not be relied on as current protection. Newer, narrower tools like rebrowser-patches address specific signals it never covered, and the deeper signals it cannot touch are unchanged.

Code example

javascript

// puppeteer-extra-plugin-stealth applies a bundle of JavaScript-surface
// evasion modules to puppeteer-extra (a wrapper around Puppeteer).
const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');
puppeteer.use(StealthPlugin());

(async () => {
  const browser = await puppeteer.launch({ headless: true });
  const page = await browser.newPage();
  await page.goto('https://example.com');
  await browser.close();
})();

// This patches the JS surface only (navigator.webdriver, UA token, plugins,
// webgl.vendor, ...). It does NOT change TLS, IP, or the real WebGL/
// SwiftShader renderer tell, and several evasions are now outdated.

Next in Driver and patch tooling · 3 of 7

A newer take that patches the browser rather than the page.

What Is rebrowser-patches?

Related terms

What Is Puppeteer?

Puppeteer is Google's Node.js library for driving a Chromium browser from code, over the Chrome DevTools Protocol (CDP) - the same channel C…

What Is Playwright?

Playwright is a cross-browser automation framework from Microsoft that drives Chromium, Firefox, and WebKit through a single API. An automat…

What Is rebrowser-patches?

rebrowser-patches is an open-source set of drop-in patches for Puppeteer and Playwright that changes how those libraries set up their CDP ex…

What Is the SwiftShader Renderer Tell?

The SwiftShader renderer tell is a bot signal that appears when a browser reports a software WebGL renderer - most often "Google SwiftShader…

What Is Headless Browser Detection?

Headless browser detection is the set of probes anti-bot systems use to distinguish a headless or instrumented Chrome session from a real us…

What Is CDP Detection?

CDP detection is the family of techniques anti-bot scripts use to tell that a browser is being driven through the Chrome DevTools Protocol (…

Concept map

How puppeteer-extra-plugin-stealth connects

The terms most directly tied to this one. Hover a node to see its neighbours, click to preview, drag to rearrange.

0 terms · 0 connections

You are here · Web Automation

Frequently asked questions

What is puppeteer-extra-plugin-stealth?

It is an open-source plugin for the puppeteer-extra wrapper that bundles a collection of JavaScript-layer evasion modules. Each module patches a specific browser property - such as navigator.webdriver or the HeadlessChrome user-agent token - so a Puppeteer-controlled Chromium looks closer to an ordinary browser.

What does the stealth plugin actually change?

It patches JavaScript-observable values: it normalises navigator.webdriver, rewrites the HeadlessChrome token out of the user-agent, and adjusts navigator.plugins, navigator.vendor, webgl.vendor, media codecs, chrome.runtime, and iframe and window properties, among others. All of it happens in the page's JavaScript context.

Is puppeteer-extra-plugin-stealth still effective?

It patches only the JavaScript surface, so it cannot change TLS, IP, or the deeper WebGL/SwiftShader renderer tell. It is also effectively stale, with several evasions outdated relative to current Chrome and detection techniques, so against modern detection it is widely considered insufficient on its own.

How is it different from rebrowser-patches?

puppeteer-extra-plugin-stealth patches a broad set of JavaScript-surface markers but is largely unmaintained. rebrowser-patches is narrower and current, addressing the CDP-layer Runtime.enable signal that the stealth plugin never covered. They target different layers.

Last updated: 2026-06-15