A new browser-fingerprinting attack, named Gummy Browser, has been demonstrated by US university researchers Zengrui Liu, Prakash Shrestha, and Nitesh Saxena. Browser-fingerprinting is the act of identifying a user or computer using a set of identifiers, such as the user agent, installed applications and add-ons, cookies, and even mouse movements and typing speed. Websites and advertisements can use a combination of these to identify a specific user or computer. The new Gummy Browser attack allows an attacker to completely copy a user’s identifiers to match the user exactly. They use three (3) methods for this: script injection, a technique which modifies the results of JavaScript API calls, Browser setting and debugging tool, which allows manipulation of a browsers settings and HTTP headers, and Script modification, changing the browsers properties by modifying the scripts on a specific website. It is impossible for a user to detect that their online fingerprint has been stolen by a Gummy Browser. The researchers’ tests returned a true positive rate of 0.9 indicating that it is even difficult for the webserver itself to detect this malicious activity. This attack has the potential to help attackers bypass security features as well as some multi-factor authentication checks from reputable authentication software.