Security Best Practices

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• README_zh.md
• main.js
• renderer.js
• CHANGELOG_v1.2.3.md
• index.html
• package.json
• setup.js

GeekEZ Browser is engineered with a primary focus on security, specifically for anti-detection and safe multi-account management. It achieves this by creating strictly isolated browser environments that mimic native browser behavior to bypass advanced detection systems. The security model is built on three pillars: advanced fingerprint isolation, robust network environment segregation, and strict process and data separation for each profile.

The architecture leverages Electron and Puppeteer to control a real Chrome browser instance, while integrating the powerful Xray-core for network proxying. This combination allows for deep customization of the browser environment at both the application and network layers, ensuring that each profile presents a unique and consistent fingerprint to web services, thereby minimizing the risk of account association and detection.

Sources: README.md, main.js

Fingerprint Isolation & Anti-Detection

The core of GeekEZ Browser's security is its ability to generate unique and realistic browser fingerprints for each profile. This is achieved through a "Native Consistency" strategy, which avoids easily detectable JavaScript hooks in favor of native configurations.

Sources: README.md, main.js

Native Injection Strategy

Instead of relying on easily detectable JavaScript hooks that modify browser APIs at runtime, GeekEZ Browser uses a combination of Chromium launch arguments and a dedicated "GeekEZ Guard" extension. This extension injects fingerprinting scripts at document_start in the MAIN world, making the modifications appear more native and harder to detect.

The generateExtension function in main.js dynamically creates a manifest.json and a content.js for each profile, ensuring the fingerprinting logic is sandboxed within the extension.

This diagram shows the process of generating and injecting the fingerprint.

Hardware and Media Fingerprint Randomization

To increase fingerprint uniqueness, GeekEZ randomizes several hardware and media-related attributes for each new profile.

Feature	Description
Hardware Randomization	Randomizes CPU Cores (4/8/12/16) and Device Memory (4/8/16 GB).
Media Noise	Adds non-intrusive noise to Canvas, WebGL, and AudioContext to create unique hardware hashes.
TLS Fingerprint	Uses a real Chrome browser, ensuring the TLS (JA3) fingerprint matches standard Chrome behavior and is indistinguishable from legitimate traffic.
Timezone Simulation	Automatically matches the browser timezone with the proxy's geographical location. This is configured in the UI and applied at launch.

Sources: README.md, CHANGELOG_v1.2.3.md, renderer.js:936-943

WebRTC IP Leak Protection

To prevent the leakage of the user's real IP address via WebRTC, the browser is launched with specific arguments that enforce a strict IP handling policy.

• force-webrtc-ip-handling-policy=disable_non_proxied_udp: This is the primary flag that physically prevents WebRTC from using network interfaces that are not part of the proxy tunnel.
• The webrtc.ip_handling_policy is also set to disable_non_proxied_udp in the browser's Preferences file for an additional layer of protection.

Sources: main.js:512, main.js:544-545, README.md

Network Security

Network traffic for each profile is strictly isolated and routed through the integrated Xray-core engine, providing powerful and flexible proxy capabilities.

Xray-core Integration

GeekEZ Browser bundles Xray-core binaries and manages a separate Xray process for each browser profile. This ensures that network environments are completely segregated.

• Full Protocol Support: Supports VMess, VLESS, Trojan, Shadowsocks, Socks5, and HTTP.
• Advanced Transports: Compatible with REALITY, gRPC, WebSocket, H2, and more.

The setup.js script handles the initial download of the correct Xray-core binary for the user's platform, using a mirror for users in China to ensure reliability.

Sources: README.md, setup.js:80-84, [main.js:21-22]

Proxy Chaining (Pre-Proxy)

The browser supports an optional pre-proxy (chain proxy) feature, which allows users to hide their real IP from the main proxy provider.

This diagram illustrates the network flow with and without the pre-proxy enabled.

The pre-proxy configuration is managed in the UI and applied by main.js when generating the Xray configuration for a profile.

Sources: README.md, renderer.js:1225-1241, [main.js:498-510]

Profile and Data Isolation

Each profile is treated as a distinct entity, with its own process, storage, and configuration, preventing any cross-contamination.

Process & Storage Isolation

When a profile is launched, a dedicated sequence of events ensures complete isolation.

This sequence diagram shows the launch process for a single profile.

Key isolation mechanisms include:

• Unique User Data Directory: Each profile is launched with a --user-data-dir argument pointing to a unique folder (/BrowserProfiles/<profileId>/browser_data), isolating cookies, local storage, and session data.
• Dedicated Xray Process: A new xray process is spawned for each profile with a unique configuration and local port.
• Process Tracking: The activeProcesses object in main.js tracks the PID of the Xray process and the Puppeteer browser instance for each active profile, allowing for clean termination.

Sources: main.js:476-621

Automatic Cache Cleanup

To save disk space and remove potentially trackable files, the browser automatically cleans cache directories when a profile is closed. The disconnected event listener for the browser instance triggers the cleanup of the Cache and Code Cache directories within the profile's user data folder.

Sources: main.js:610-616, README.md

Application Security & Best Practices

Safe Profile Identification

To avoid detection methods that scan for modifications to document.title, GeekEZ Browser displays the current profile's name in the Bookmarks Bar. This is a non-intrusive method that doesn't alter the DOM of the loaded page. The main.js process writes a Bookmarks file into the profile directory before launch.

Sources: README.md, main.js:549-552

Secure Extension Loading

The application provides a sandboxed way to load both the internal "GeekEZ Guard" extension and user-defined extensions.

• The --disable-extensions-except and --load-extension flags are used to control which extensions are active.
• The UI in renderer.js and backend logic in main.js allow users to add and manage their own unpacked Chrome extensions, which are then loaded into the isolated profile environments.

Sources: mainjs:568-571, renderer.js:1443-1451

Recommended User Practices

The application documentation and UI provide guidance for maintaining a high level of security.

Practice	Rationale
Use High-Quality IPs	The quality of the proxy IP (e.g., residential) is a major factor in avoiding detection.
One Account Per Environment	Prevents account association by ensuring a consistent fingerprint for each account.
Simulate Real User Behavior	Avoid high-frequency automation or unnatural actions that can trigger bot detection.
Fixed Environment	Avoid frequently switching proxy or fingerprint settings for a single account.

Sources: README.md, renderer.js:330-333