Cloudflare Turnstile leaks device fingerprints via WebGL

Security researcher HypnoticOcelot found that Cloudflare's Turnstile CAPTCHA alternative exposes unique device identifiers through WebGL queries, potentially enabling tracking across sites. The discovery highlights a privacy tradeoff in Turnstile's design—solving one problem (user friction) while creating another (fingerprinting surface).