Gabriel d526a4da7d js: make event.isTrusted false for page-constructed events ...

isTrusted was hardcoded to true for every Event, so new Event('x').isTrusted returned true. Real browsers return false for script-constructed events and true only for user-agent dispatched ones, so this was a trivial bot-detection tell (Closes #303).

Track trusted events in a closure-private WeakSet that page JS cannot read or forge; default isTrusted to false. The CDP input pipeline marks its synthesized mouse/key events trusted via a non-enumerable __obscura_markTrusted helper, so automation clicks stay trusted like real Chrome over CDP while page-built events report false.

2026-06-17 15:15:25 +00:00

..

src

js: make event.isTrusted false for page-constructed events

2026-06-17 15:15:25 +00:00

tests

feat(stealth): many stealth improvements

2026-06-03 08:21:14 +00:00

Cargo.toml

fix(#19): serialize V8 work across pages with process-wide async lock (#36)

2026-05-09 18:26:38 +02:00