reCAPTCHA v2 challenges CloakBrowser on ~9/10 attempts where the identical click passes ~9/10 on another Chromium — same proxy exits, same click, same page

Description:

reCAPTCHA v2 (the checkbox on https://seleniumbase.io/apps/recaptcha) raises the image grid on almost every press in CloakBrowser, while the same click code, through the same residential proxy exits, against the same page, gets the free pass on almost every press in a hosted Chrome 140 (Scrapeless). Best CloakBrowser configuration out of six: 2/10. Pooled: 4/50 ≈ 8%. Comparison browser: 24/26, then 6/6 tasks twice (1.2–1.5 tries per pass with exit rotation).

The clicks land — the challenge frame (bframe) grows from 300×150 to 400×580 within 1–3 s of every press, measured over CDP DOM.getContentQuads. In the strictest run (native Windows, six-way verdict) the result was 8 CHALLENGED · 0 PASS · 0 DEAD_PRESS · 0 NO_WIDGET · 2 SITE_DOWN. So this is Google deciding to challenge, not an input or widget-loading problem.

Expected: roughly the pass rate of a stock Chrome on the same exits (~90 % here). Observed: ~8–10 %, and the same exit IPs flip verdict depending only on which browser presents them.

Same-exit contrast (same day, same click bytes):

All runs:

The click is a port of SeleniumBase's solve_captcha() (sb_cdp.py::__gui_click_recaptcha, use_cdp=True): hover the anchor iframe centre, press/release at top-left + (26,35) via Input.dispatchMouseEvent with force=0.5/0.0. The CloakBrowser script imports that algorithm from the Scrapeless script — same bytes, only the transport differs. A bare Playwright click at the same point passed at the same rate on Scrapeless, so the event shape is not what matters.

Ruled out on my side: input path (0 dead presses, grid rises ~1 s after every press), widget readiness (explicit stable-box wait + 8 s settle, 0 NO_WIDGET), fonts (507 Windows/Office fonts staged, 47 Segoe/Calibri/Consolas faces verified live via fc-list — no change), Xvfb/GPU/desktop (native Windows: 0/10), proxy pool (same product, same exits), click event shape (bare Playwright control), protocol chatter (no wait_for_timeout, no evaluate beyond window.innerWidth/Height, DOM reads via DOM.* only), headless (headless=False throughout, bring_to_front() before the press), 3p cookies (--fingerprint-allow-3p-cookies). Not tested: a paid-plan binary other than the one the free plan serves; a different site key. n = 10 per configuration — single-attempt differences are noise, the direction is not.

CloakBrowser version: cloakbrowser 0.5.10 (pip, [geoip] extra); binary chromium-151.0.7922.108.6-pro (free plan: "latest binary, 1 concurrent session"; validate_license → plan: free)

Wrapper: Python

Environment:

• (a) Linux x86_64, Docker yes, base image cloakhq/cloakbrowser (its own entrypoint's Xvfb :99 + openbox), Debian; two derived images — vendor image as-is, and vendor image + host Windows fonts (Dockerfile below)
• (b) Windows 11 Pro 10.0.26200 x64, no Docker, native desktop, Python 3.12.7, venv at a short path
• Same result on both.

Launch options:

from cloakbrowser import launch
browser = launch(
    headless=False,                      # a headless CloakBrowser discards the press (measured)
    proxy="http://user:[email protected]:8789",   # one sticky session per attempt
    geoip=True,
    humanize=True,
    human_preset="careful",
    timeout=60_000,
    args=[
        "--fingerprint-allow-3p-cookies",
        "--fingerprint-windows-font-metrics",
        "--fingerprint-storage-quota=5000",
        # --fingerprint-noise left at default; no --fingerprint=<seed> (fresh identity per launch)
    ],
)
page = browser.new_page()

Tested with a different IP or proxy? Yes (same result). Ten distinct sticky residential exits per run, country_ANY (worldwide) and country_FI, two gateways (gw-eu, gw-us). The same exits pass in the comparison browser (table above), so it is not the IPs.

Works outside Docker / on host machine? No — native Windows 11 with real fonts, GPU and desktop: 0/10 (8 challenged, 2 transport errors). Docker and host give the same result.

Steps to reproduce:

1. Unzip the attached cloakbrowser-recaptcha-issue.zip.
2. Put one sticky residential proxy per line in cloak_proxies.txt (host:port:user:pass, see cloak_proxies.example.txt). Ten lines = ten attempts.
3. CloakBrowser arm, native:
   复制

   CLOAKBROWSER_LICENSE_KEY=… CLOAK_PROXIES_FILE=cloak_proxies.txt CLOAK_ATTEMPT_TIMEOUT_S=900 python cloakbrowser_sb_recaptcha.py

   or Docker:
   bash复制

   docker build -f Dockerfile.cloak-fonts -t cloak-sb-fonts .      # (or Dockerfile.cloak-sb, no fonts)
   docker run --rm --shm-size=2g -e CLOAKBROWSER_LICENSE_KEY -v cloak-cache:/root/.cloakbrowser cloak-sb-fonts

4. Each attempt: launch → goto → wait for the anchor iframe to hold a stable ≥120×40 box for 3 consecutive 1 s reads → sleep 8 s → the click → poll 45 s for token (PASS) or bframe ≥380×400 (CHALLENGED). Every attempt runs in its own process (see notes for why).
5. Comparison arm on the same proxies (needs a Scrapeless token):
   复制

   SCRAPELESS_TOKEN=… SB_TASKS=6 SB_MAX_TRIES=5 SB_PROXY_COUNTRY=FI python scrapeless_sb_recaptcha.py
   SB_PRESS=playwright …   # bare Playwright click control

6. To confirm the click lands: python cloak_diag_bframe.py prints the bframe box before/after the press.

Error output / screenshots:

No error — the run completes; the widget simply challenges. Six-way native run (full log attached as logs/cloak_native_sixway.log):

[1/10] proxy gw-us.scrapeless.io:8789 session=8zGZiZW7z7
    hover=(220,186) press=(94,182) release_buttons=1
  CHALLENGED  grid 400x580 raised after 1.0s (was 300x150)  exit=85.76.162.70  34s
[2/10] … CHALLENGED  grid 400x580 raised after 1.0s (was 300x150)  exit=45.82.16.204  28s
[3/10] … CHALLENGED  grid 400x580 raised after 1.0s (was 300x150)  exit=86.50.90.148  25s
[4/10] SITE_DOWN   Page.goto: net::ERR_CONNECTION_CLOSED
[5/10] … CHALLENGED  grid 400x580 raised after 1.0s  exit=85.134.84.233
[6/10] SITE_DOWN   Page.goto: net::ERR_TUNNEL_CONNECTION_FAILED
[7/10] … CHALLENGED  grid 400x580 raised after 1.0s  exit=84.251.62.116
[8/10] … CHALLENGED  grid 400x580 raised after 2.1s  exit=80.220.36.158
[9/10] … CHALLENGED  grid 400x580 raised after 1.0s  exit=84.249.194.116
[10/10] … CHALLENGED  grid 400x580 raised after 3.1s (was absent)  exit=80.186.219.102
PASSED 0/10
captcha-scored 8:  PASS 0  CHALLENGED 8  DEAD_PRESS 0
not captcha    2:  NO_WIDGET 0  SITE_DOWN 2  ERROR 0  HANG 0

Same harness, same proxies, Scrapeless hosted Chrome 140, bare Playwright click (logs/scrapeless_playwright_control.log):

[1/5] PASS   token/success after 1.0s   exit=86.60.147.205    -> task 1: PASS on try 1
[2/5] PASS   token/success after 0.5s   exit=84.251.39.202    -> task 2: PASS on try 2
[1/5] PASS   token/success after 0.4s   exit=188.67.133.145   -> task 3: PASS on try 1
[1/5] PASS   token/success after 15.3s  exit=46.62.135.255    -> task 4: PASS on try 1
[3/5] PASS   token/success after 0.5s   exit=188.123.30.29    -> task 5: PASS on try 3 (2 CHALLENGED first)
[1/5] PASS   token/success after 0.3s   exit=84.249.194.116   -> task 6: PASS on try 1
TASKS PASSED 6/6 (100%)  avg 1.5 tries per pass

One actual crash, separate from the captcha result — native Windows, cloakbrowser info attempting a test-launch while another session held the seat:

Launch: x failed — [43892:39920:0914/112040.328:FATAL:base\allocator\partition_alloc_support.cc:822] Detected dangling raw_ptr in unretained with id=0x00005884000b4fbc

Dockerfile (if applicable):

# Vendor image + the build host's real Windows/Office fonts (the binary presents a
# Windows UA; a bare Debian font list is incoherent). Built on a Windows host via
# Docker Desktop so C:\Windows\Fonts is available; the plain variant
# (Dockerfile.cloak-sb, attached) is the same minus the two font lines.
FROM cloakhq/cloakbrowser

COPY cloak-fonts/ /usr/local/share/fonts/windows/        # 507 files staged from C:\Windows\Fonts
RUN fc-cache -f >/dev/null 2>&1 && \
    echo "fonts registered: $(fc-list | wc -l)" && \
    echo "segoe/calibri/consolas: $(fc-list | grep -ciE 'segoe|calibri|consolas')"

RUN pip install --no-cache-dir --break-system-packages "cloakbrowser[geoip]" 2>/dev/null || \
    pip install --no-cache-dir "cloakbrowser[geoip]"

RUN apt-get update && apt-get install -y --no-install-recommends xdotool x11-utils \
    && rm -rf /var/lib/apt/lists/*

COPY scripts/scrapeless_sb_recaptcha.py scripts/sb_cdp_dom.py \
     scripts/cloakbrowser_sb_recaptcha.py scripts/cloak_diag_bframe.py \
     scripts/cloak_proxies_fi.txt /app/

WORKDIR /app
ENV DISPLAY=:99 CLOAK_PROXIES_FILE=/app/cloak_proxies_fi.txt
CMD ["python", "/app/cloakbrowser_sb_recaptcha.py"]

Additional notes:

Things I hit while running this, reported in case they are useful (all reproducible from the attached scripts):

• launch() can hang indefinitely. After the binary exited on a license-seat denial, launch() sat for 8+ minutes with the Playwright driver alive, no browser process, no exception. Nothing inside the same process can catch that; the attached harness runs each attempt in a child process with a wall-clock kill.
• Seat denial surfaces late. Exit code 76 becomes CloakBrowserLicenseError at the next protocol call (page.goto), not from launch() — a try around launch() misses it.
• Seat orphaning. A browser not closed before its container stopped kept the seat held server-side for ~15 min ("session limit reached" on every attempt). The harness now closes the browser on SIGTERM; on Windows a hard kill still can't, so a stalled attempt there orphans the seat.
• cloakbrowser install timed out at 59 % of 515 MB ("The read operation timed out", vendor CDN); launch() completed the download itself. Worth generous first-launch timeouts.
• pip install cloakbrowser fails in a long directory on Windows (MAX_PATH — the Playwright driver tree nests ~110 chars). A short venv path fixes it.
• --fingerprint-windows-font-metrics on an image with no Windows fonts is an active contradiction; I ran both with and without the fonts — no difference to the captcha result either way.

Questions: is there a known reCAPTCHA v2 tell in the 151 build, or a fingerprint dimension Google's v2 risk analysis is likely keying on here? Happy to run any variant you suggest — a specific flag, a different build or plan, a different site key.

Attachments (cloakbrowser-recaptcha-issue.zip, credentials removed): scrapeless_sb_recaptcha.py · cloakbrowser_sb_recaptcha.py · sb_cdp_dom.py · sb_verdict.py · cloak_diag_bframe.py · Dockerfile.cloak-sb · Dockerfile.cloak-fonts · cloak_proxies.example.txt · logs/cloak_native_sixway.log · logs/scrapeless_playwright_control.log

cloakbrowser-recaptcha-issue.zip