elGumso iBAT

Interactive Browser Audit Tool · read-only · single-page · safe-by-default
Click Pre-flight check first — confirms popups + storage are unblocked so the manual panel and click probes work. Then Run Scan.

CVE overlay awaiting scan

Curated list of Chromium CVEs that affect the version this browser reports. Not exhaustive — biased toward in-the-wild zero-days and bugs reachable from a single page. "Behind by N versions" = milestones from upstream stable as of the dataset date. Populated after the first scan POSTs to the server. On non-Chromium browsers (Firefox/Safari) you'll see "no Chromium milestone in UA".
CVEfixed inseverity categorycomponentsummary

Engine fingerprint

Feature matrix

Show all

URL schemes

What the columns mean
navigated = browser accepted the URL into a hidden iframe (capability present). refused = browser actively rejected (e.g. file:// from a web origin is universally refused — this is the expected, correct outcome, not a probe failure). silent = neither load nor error event fired; either the scheme was silently dropped or an external OS handler took over without iframe feedback (typical for tel:, intent:). fetch column shows whether HEAD on that URL returned content; most non-http schemes throw, which is expected.
Show table
schemecategorylikelihood verdictfetchnote
Manual scheme tests 0
Tap any link to manually test that scheme. Each opens in a new tab so the scanner page stays alive. User taps have gesture status that programmatic clicks lack — schemes that auto-probed as silent often dispatch on tap. Allow popups for this site first or the new tabs will be silently blocked. Sorted: silent → refused → external → navigated.

chrome:// hosts

Show table

Network observations

TLS / proxy fingerprint

JA3/JA4 fingerprints + TLS metadata as forwarded by your reverse proxy. Identifies the underlying net stack independent of UA. Empty result means no proxy is forwarding fingerprint headers — see /api/tls-fingerprint response for setup hints.

Storage / Service Worker

WebGPU / WebCodecs (Tier-B)

Spectre timer resolution

Measures performance.now() minimum delta, SAB+Worker counter-clock incrementation rate, and Atomics.wait jitter. Modern Chromium clamps timers to ~5µs (or ~1µs in crossOriginIsolated). Sub-microsecond resolution = Spectre-class side channels viable from this renderer.
Raw JSON

Headers round-trip

Sends a fetch with explicit custom headers and a sentinel value, compares against what the server received. Reveals what the Tesla net stack / upstream proxy strips, adds, or rewrites. Response sentinel header verifies the return path too.
Raw JSON

Sandbox relaxation

Behavioural detection of non-default Chromium command-line flags (--disable-web-security, --allow-running-insecure-content, --user-agent, --js-flags=--jitless, --enable-automation, headless, etc.) by observing the renderer's behaviour from pure JS. Cross-reference with the site-isolation panel below for the strongest signal.
Raw JSON

Site isolation / process model

Inspects crossOriginIsolated, originAgentCluster, document.domain mutability, SharedArrayBuffer + isolation gating, COOP/COEP/CORP response headers, and window.opener state. Findings highlight embedded-fork relaxations of the modern process model.
Raw JSON

Safe Browsing reachability

Tries to fetch Google's Safe Browsing test URLs (testsafebrowsing.appspot.com). All listed targets are safe to navigate — they're flagged but only serve to trigger the SB telemetry path. Many reached → SB likely disabled (defensive-posture finding). All throw → SB on (or no network — use the manual links to confirm visually).
Manual test links — tap to verify in-car

Device fingerprint hashes

Canvas pixel hash, audio-stack DSP hash, font enumeration, speech voices list, media device counts. Compose into a single compositeHash that's stable per firmware. Diff scans across Tesla OTA updates to detect when the rendering / audio / font stacks change underneath an unchanged UA string.

Tier-C (advanced — opt-in)

Enabled via the Advanced toggle above. Compiles malformed WebGPU shaders, feeds malformed bitstreams to the WebCodecs decoder, registers a transient Service Worker (cleans up immediately), and HEAD-probes well-known private IP subnets. All non-destructive, all read-only. Not run when the toggle is off.

Live log