Camoufox Review 2026: What a C++-Patched Firefox Really Gets You Past Cloudflare
Camoufox changes browser fingerprints inside Firefox's source code, drops into Playwright scripts, and costs nothing. But its original maintainer stepped back in January, independent tests disagree about how well it works, and several claims in our July review didn't survive checking.
📋 Table of Contents
This Camoufox review 2026 is a rewrite, because three things in the July version didn't hold up: the framing that it beats "every major WAF", a 70%+ CreepJS score stated as fact, and a "CloverLabs Managed" enterprise plan that doesn't appear to exist. What survives is still a genuinely clever idea, and a free one.
Camoufox is a custom Firefox build for scraping and AI agents. Instead of hiding automation with JavaScript patches that detection scripts can sniff out, it changes what the browser reports from inside the engine. That is a sound design. Whether it gets you through a given site's defenses depends on layers it doesn't control, and on a project that has recently changed hands.
What Camoufox Actually Is
Camoufox describes itself as a Firefox fork engineered for AI agents: minimal, debloated, and cheap to run. Its pitch is that fingerprint values are altered in the browser's own code, so page scripts read the changed values directly rather than a patched layer on top.
By default, the fingerprint values are synthesized by BrowserForge, a library that generates internally consistent combinations of device properties. The newer alpha package adds something more interesting: bundled presets built from real fingerprints scraped from in-the-wild Firefox traffic, 312 of them covering Firefox 149 to 152 (67 macOS, 180 Windows, 65 Linux). The idea is that a real fingerprint from a real user beats a synthesized one against consistency checks.
It works with your existing Playwright code through Python's sync and async APIs, so moving a scraper over mostly means changing how the browser launches. That's why it keeps coming up in stories about replacing brittle Playwright setups. One boundary is stated in the README itself: Camoufox does not fully support injecting Chromium fingerprints, so it presents as Firefox, always.
Core Capabilities
In-engine fingerprint spoofing
Changes are made in the Firefox build, with BrowserForge generating consistent device profiles per session.
Real-world fingerprint presets
The cloverlabs-camoufox alpha package ships 312 presets from real Firefox traffic, auto-selected for Firefox 149 and newer binaries, and adds per-context fingerprints and hardware spoofing.
Isolated Playwright agent
Playwright's internal page-agent code runs in an isolated scope outside the page, so page scripts can't see it. A headless-detection fix via pointer type is also listed in the README.
Human-like cursor movement
An optional movement algorithm generates distance-aware trajectories instead of instant jumps.
Add-ons without a debug server
Load Firefox add-ons by passing a list of paths in the launch configuration.
The Handoff: A Year-Long Gap and a New Maintainer
The repository's README says there was a year gap in maintenance because of a personal situation, and that the project is under active development again. Our July article gave this one line and moved on. It deserves more weight, because it determines how long any fingerprint you ship will stay believable.
On January 10, 2026, the original developer, daijro, announced in a maintenance thread that he was stepping down as primary maintainer and that Clover Labs, a Toronto venture studio that builds AI agents, had taken over day-to-day development. Some commenters worried about an eventual closed-source, monetized version. A Clover Labs collaborator replied that the core repository remains owned by daijro, that Clover Labs didn't buy it, that its own fork had been public for months, and that its business doesn't depend on keeping stealth patches private. That is a stated intention, not a guarantee, so it's worth watching.
For users, the handoff shows up in two ways. There are now two install paths: the stable camoufox package, and the cloverlabs-camoufox alpha package for newer features. And at least one user in that thread was still asking about Windows support in June 2026. Our earlier article called the project "built by independent developer daijro" and listed a "CloverLabs Managed" enterprise plan with custom pricing; the first is no longer accurate and we couldn't find any support for the second, which looks like an alpha pip package rather than a service.
Does It Actually Beat Cloudflare? What Independent Tests Say
It depends heavily on the site, the proxy and the day. Here is what we found from outside sources, and why none of it supports "every major WAF".
| Source | What they found | Caveat |
|---|---|---|
| The Web Scraping Club wiki (2026) | 99% success on 100 requests to a Cloudflare-as-CDN site; 31% on Indeed's stricter Turnstile setup | Authors attribute the Indeed shortfall to rate limiting after about 29 URLs, not bot detection |
| Ian Paterson's 7-tool benchmark (Aug 15, 2026) | Camoufox hit a Cloudflare interstitial on a Turnstile-protected page that Chrome 148 over plain CDP passed; it did pass Google Search | Single-IP setup, described by the author as the worst case for Camoufox |
| techinz browsers-benchmark (cited in that post) | 100% for Camoufox versus 83.3% headed and 50% headless for CloakBrowser | Rotating residential proxies and up to 3 retries per test |
| ScrapingBee guide (2026) | With a cross-origin option enabled, a click on the Turnstile frame passed on a Cloudflare demo and on Crunchbase | Found no public DataDome test page; notes TLS fingerprint is a standard Firefox profile; ScrapingBee sells managed scraping APIs |
The pattern is consistent across sources. Fingerprint quality gets you in the door on some configurations, but IP reputation, TLS signatures and behavior are separate layers Camoufox doesn't change, and ScrapingBee says outright that the TLS profile can't be changed. We found no independent evidence either way for DataDome, Akamai, PerimeterX or Imperva, so we've removed those claims. A repeated-hit test from one IP looks very different from a rotating-proxy test, which explains much of the spread above. If a managed service is more attractive than maintaining this yourself, our piece on a browser automation API and our roundup of AI browser agents show the alternatives.
What It Costs: The Browser Is Free, the Rest Isn't
We found no hosted or paid version of Camoufox itself. Everything it costs you comes from the pieces around it, and the largest of them is usually the proxy bill.
Pros and Cons
✓ What Works
- ✅ Free and open source, with a Playwright-compatible Python API that keeps migration cost low.
- ✅ The in-engine design avoids the JavaScript-patch tells that detection scripts look for.
- ✅ Independent tests show passes on some Cloudflare configurations, especially with rotating residential proxies.
- ✅ A candid README that admits the maintenance gap and performance drop.
- ✅ Active alpha development, including real-traffic fingerprint presets for newer Firefox versions.
✗ What Holds It Back
- ❌ A maintainer transition and a stable-versus-alpha package split to navigate.
- ❌ Reports of Windows support lagging behind in the maintainer thread.
- ❌ Firefox-only: it does not fully support Chromium fingerprints.
- ❌ TLS signature, IP reputation and behavior sit outside its control, so results vary by site and proxy.
- ❌ We found no built-in CAPTCHA solver documented, so hard challenges mean adding another service.
✅ Choose Camoufox if...
You write Python with Playwright, target sites that rely on browser fingerprinting, can pair it with quality proxies, and have an engineer who can retest after each update.
❌ Look elsewhere if...
You need a vendor SLA, Chromium fingerprints, Windows-first stability, or a guaranteed pass on DataDome or Akamai. Also check each target site's terms and local law before automating it.
Expert Editorial Opinion
Our July review treated Camoufox as a finished product. It is a project in transition, and the evidence we used to rate it was thinner than the tone suggested. A 70%+ CreepJS score and the phrase "indistinguishable from a real browser" were repeated as validation, but a fingerprint test isn't a real-world bypass, and neither claim could be tied to a current, checkable source.
The idea is still good.
Changing a browser's reported properties inside the engine, rather than papering over them in JavaScript, is the right way to attack fingerprint-based detection, and it's why Camoufox keeps showing up in serious comparisons. But a fingerprint is only one layer. Independent tests show wide swings: near-perfect on a lightly configured Cloudflare site, weak on a stricter one where rate limiting dominated, and a failure in a single-IP benchmark where the author called Camoufox's Firefox TLS profile easy to recognize. The honest summary is "a strong component", not "a solution".
The pricing question inverts here. Normally we ask whether a tool is worth paying for without a free tier; this one is free, so the question is whether it's worth the maintenance risk without a vendor behind it. For a team with engineers and a monitoring habit, yes: you're paying in attention instead of subscription fees. For a team that wants one request to return one page, managed scraping services charge precisely for the maintenance Camoufox leaves to you.
A note on confidence: this is a desk review. We didn't run Camoufox against any site, and our sources, a project README, a maintainer thread and four third-party benchmarks, use different methods that don't line up neatly.
Final Verdict
Competent but compromised: Camoufox earns a place in the toolkit of teams that can test and maintain what they build on it. The design is sound, the price is zero, and the maintainers are open about the project's recent problems. The score drops from the original 9.1 because independent evidence is mixed, project continuity is still being proven after the handoff, and claims we previously repeated about universal WAF bypass can't be supported.
| Dimension | Weight | Score /10 | Why |
|---|---|---|---|
| Technical quality | 30% | 7.0 | Sound in-engine design; independent results range from near-perfect to blocked |
| Price-to-value | 25% | 9.5 | Free and open source; real costs are proxies and engineer time |
| Maturity & documentation | 20% | 5.5 | Year-long gap, maintainer change, stable/alpha split, Windows lag |
| Ceiling & flexibility | 15% | 7.0 | Self-hosted, Playwright-compatible; Firefox-only, JS port is experimental |
| Honesty of positioning | 10% | 8.5 | README states the maintenance problems plainly; third-party hype is the issue |
| Weighted total | 100% | 7.475 | (2.10 + 2.375 + 1.10 + 1.05 + 0.85) |
❓ Frequently Asked Questions
🔗 Related ToolRadar Reviews
Official sources: Camoufox documentation · Main repository · Clover Labs repository · Maintenance announcement.
Comments
Post a Comment