This is the kind of side-channel fingerprinting story that reminds you the browser is a leaky abstraction all the way down. The premise: browsers ship hyphenation dictionaries to break words correctly at line ends for CSS hyphens: auto. Those dictionaries aren't identical across operating systems — Chrome on macOS uses the system's CoreFoundation hyphenator, Chrome on Linux ships Hunspell-derived patterns, and Windows has its own variant. Feed the browser carefully chosen words that hyphenate differently across these implementations, measure the resulting DOM layout, and you can read the underlying OS without touching the User-Agent string at all.

Why this matters to a technical audience:

• UA-CH and privacy budgets don't help. Chrome's User-Agent Client Hints reduction was supposed to blunt passive OS fingerprinting. This bypasses it entirely by exploiting a rendering feature nobody thinks of as identifying.
• It's passive and cheap. No permission prompts, no canvas readback that triggers privacy heuristics, no font enumeration. Just measure element widths after applying hyphens: auto. That means it's very hard to detect defensively and trivial to add to an existing fingerprint stack.
• It's a great case study in "features are fingerprints." Hyphenation was added for typography. Nobody in the CSS WG signed off on a per-OS oracle. This is what shipping platform-specific implementations of user-facing features looks like from an adversarial angle — every dictionary, every ICU version, every emoji font update is a potential bit of entropy.
• The mitigation story is genuinely hard. You can't ship one universal hyphenation dictionary without regressing typography for languages the OS handles better. You can't disable hyphens: auto without breaking print stylesheets and readable long-form content. The path forward probably looks like Firefox's Resist Fingerprinting mode — bundle a canonical dictionary and accept the typography hit — but browsers don't do that by default.

Scrapfly writes from the scraping/anti-bot side of the industry, which means their fingerprinting posts tend to be practical rather than theoretical — they're describing what actually gets deployed in production bot detection, not academic curiosities. If you build anti-fraud, privacy tooling, or headless browser infrastructure, this is worth adding to your threat model today.