Privacy Test Pages

🛡 Collection of pages for testing various privacy and security features of browsers and browser extensions.

View source and contribute on GitHub.

Tracker Reporting

• 1 major tracker loaded via script
• 1 major tracker with surrogate
• 1 major tracker loaded via img
• Image loaded via document fragment [Delay 5s]
• 1 major tracker loaded via fetch [Delay 5s]

Ad attribution flow

• Example search ad attribution flow

Browser Features

• Geolocation
• Permissions API (webCompat)
• Links Open in New Window
• window.close() Link
• Simple text area for editing
• URL Schemes
• Stack tracing
• Canvas draw
• Video → Canvas capture (camera + file)
• Downloads
• Print
• Fonts
• Autoconsent Feature Tests
• Navigator Interface
• WebKit Message Handlers Visibility (Apple) — readout + Notification / print buttons to validate the appleNullifyMessageHandlersExperiment on iOS and macOS
• DuckDuckGo detection (Bowser)
• PDF Viewer Capability
• JS alerts and Hanging
• window.onerror / unhandledrejection test
• Local storage
• Client Hints
• Harmful APIs
• Element Hiding
• Auto Refresh
• Favicon
• Blob URL Navigation
• Network Errors
• Autoplay Policy Tests (WebKit)
• Web Interference Detection
• CAPTCHA Detection Reference — manual reference for the web-detection captcha detectors (reCAPTCHA, hCaptcha, Turnstile, Cloudflare, DataDome, Imperva, Arkose, GeeTest, AWS WAF)
• Site Permissions (iframe identity) — verifies which origin the browser uses for permission storage when a permission is requested from an iframe
• Iframe Media Prompt Repro — triggers a Claude-like cross-origin iframe enumerateDevices() + getUserMedia() sequence to verify prompt visibility vs iframe API blocking
• Device Enumeration Chaos — catalogue of enumerateDevices, getUserMedia, permissions and RTCPeerConnection calls to isolate which API surfaces the Windows OS camera prompt (OPS-7378)

Security

• Address Bar Spoofing
• Infinite location.reload() loop
• Leak of extension IDs via CSP
• Detect changes to JS objects in global scope
• Popup noopener/noreferrer tests
• Malicious Site Protection Test Pages

Privacy Protections Tests

• Tracker Blocking - verifies blocking of many different types of tracking requests
• Request Blocklist - verifies blocking (and allowing) of requests via the privacy config
• Fingerprinting
• Fingerprinting canvas verification
• Fireproofing cookie test
• Storage blocking
• Storage partitioning
• Referrer trimming
• HTTPS upgrades
• HTTPS upgrade loop protection
• Facebook click to load
• YouTube click to load
• Surrogates
• Global Privacy Control
• AMP Links
• AMP Loop Protection
• Query Parameters
• Local port scanning
• Local network access
• Bounce tracking

Autofill

Note: Autofill features currently only work on secure contexts, so no http://.

• Address form submission detection and autofill
• Card form submission detection and autofill
• Email autofill when form is within an iframe
• Email autofill form within self-closing modal
• Form submission detection and autofill
• Form submission detection and autofill within an iframe
• Form submission detection and autofill within an same frame iframe
• Password generation during signup
• Password update/reset forms
• Forms within shadow DOM
• Credit card form with various inputs and focus events
• Login with identity
• Autoprompt credentials autofill when a login form is front and center
  • Sign up form present on pageload
  • Login form present on pageload
  • Login form in modal
  • Multistep login form
  • With dialog covering the form
  • Form below the fold on mobile but in sidebar on larger screens
  Multi-step test forms for partial form saves
  • Multistep login form
  • Multistep signup form
  • Multistep signup form with password confirmation
  • Password reset flow

Other

• Crawler Detectability test
• API call attribution test
• Site specific tracker blocking test
• 🗑️ Clear domain data
• Viewport test cases
• Windows Browser: MainWorld Script injection tests
• Windows Browser: SecureWorld Script injection tests
• Webcompat tests
• C-S-S infra
• C-S-S core tests
• Element Hiding (C-S-S)
• Site Breakage Reach Calculator
• x-safari-http(s) Scheme