How Obscura works
Obscura is a Cargo workspace of six crates: a CLI (fetch/scrape/serve + load balancer), a CDP WebSocket server, a Page abstraction, an HTTP client (reqwest by default, wreq for TLS impersonation under --features stealth), the V8 runtime, and an html5ever DOM with the selectors crate for CSS queries. On navigation it fetches the HTML, parses it, fetches CSS in parallel (but only stores it as a string — never applies it), boots V8 from a compile-time snapshot, and executes the page scripts.
All anti-detection lives in a 3,035-line bootstrap.js shim executed before page scripts: it defines navigator with webdriver=undefined, a Chrome 145 UA, userAgentData/UA-CH payloads, a 5-plugin list, and stubs for mediaDevices/battery/permissions. There are no C++ or binary patches — every override is JavaScript.
Why it is weak against real anti-bots
Obscura is not a full browser. Because it has no layout engine, getBoundingClientRect() returns {0,0,0,0} for every element and getComputedStyle returns stub values — both trivially detectable by Layer-5 (rendering/layout) probes. Its canvas, WebGL, and audio are not real implementations, so any fingerprinting service that hashes actual canvas/WebGL output flags it instantly. The UA is hardcoded Linux. It defeats only basic navigator.webdriver-style checks; against DataDome, Kasada, Akamai, PerimeterX, or even Cloudflare beyond the free tier, it fails.
When to use Obscura
Use it when: you need to render JavaScript on unprotected pages at high concurrency and a real Chrome instance (~200MB) is too heavy — Obscura's ~30MB workers let you run many in parallel. The repo's suggested pattern is a hybrid: Obscura handles the easy bulk, and Patchright/Camoufox handle the few protected targets. Avoid it when: the target uses any fingerprint-aware or layout-probing detection — it has no answer to those. It is a lightweight JS-rendering engine, not an anti-detect browser.