How Obscura works
Obscura is a Cargo workspace (a multi-part Rust project) of six crates: a CLI (fetch/scrape/serve + load balancer), a CDP WebSocket server that automation tools connect to, a Page abstraction, an HTTP client (reqwest by default, or wreq for TLS impersonation — copying a real browser's encryption handshake — under --features stealth), the V8 JavaScript runtime, and an html5ever DOM with the selectors crate for CSS queries. When you navigate to a page, it fetches the HTML, parses it, fetches the CSS in parallel (but only keeps it as a string — it never applies it), starts V8 from a precompiled snapshot for fast boot, and runs the page's scripts.
All anti-detection lives in a single 3,035-line bootstrap.js shim that runs before the page's own scripts. It fakes a browser environment in JavaScript: it defines navigator with webdriver=undefined (the flag that gives automation away), a Chrome 145 user-agent, userAgentData/UA-CH payloads (the structured browser-identity hints sites read), a 5-plugin list, and stubs for mediaDevices/battery/permissions. There are no C++ or binary patches — every override is plain JavaScript.
Why it is weak against real anti-bots
Obscura is not a full browser, and detectors notice. Because it has no layout engine — nothing that computes where elements sit on screen — getBoundingClientRect() returns {0,0,0,0} for every element and getComputedStyle returns placeholder values. Real browsers never do that, so Layer-5 (rendering/layout) probes catch it at once. Its canvas, WebGL, and audio are not real implementations either, so any fingerprinting service that hashes the actual pixels a browser draws will flag it instantly. The user-agent is hardcoded Linux. In practice it satisfies only basic navigator.webdriver-style checks; against DataDome, Kasada, Akamai, PerimeterX, or even Cloudflare beyond the free tier, it fails.
When to use Obscura
Use it when: you need to run JavaScript on unprotected pages at high volume and a real Chrome instance (~200MB each) is too heavy — Obscura's ~30MB workers let you run many at once on the same machine. The repo suggests a hybrid setup: Obscura handles the easy bulk, while Patchright/Camoufox handle the few protected targets. Avoid it when: the target uses any fingerprint-aware or layout-probing detection — Obscura has no answer to those. Think of it as a lightweight JS-rendering engine, not an anti-detect browser.