Browser Privacy 2026: What Changed Since Lockdown Mode (4-year retrospective)

#webdev #security #privacy #browsers

Cross-posted from alexi.sh — PrivSec Lab independent research.

When iOS 16 shipped Lockdown Mode in September 2022, the immediate measurement was clear: Octane 2.0 collapsed by more than 95%, Speedometer 2.0 lost ~65%, JetStream 2.0 dropped ~88%. JIT disabled meant interpreter-only execution.

Four years later (2026), what actually changed?

Lockdown Mode performance in 2026

On iPhone 15 (A16) and iPhone 16 (A18) running iOS 18.4 with Safari 18.4:

Speedometer 3.0: ~32% gap normal vs Lockdown (was ~65% on Speedometer 2.0 in 2022)
JetStream 2: gap remains ~88% (DFG/FTL still disabled, JIT-bound)
MotionMark 1.3: ~16% gap (rendering pipeline barely affected)

The ~33-point Speedometer 3.0 improvement isn't because Lockdown Mode tolerates more JIT. It's because WebKit shipped interpreter improvements between iOS 17 and iOS 18:

Superinstruction folding in LLInt
Inline cache integration at interpreter level
Profile-guided warm-up hints in iOS 18 dyld shared cache

Full benchmark methodology: WebKit JIT benchmarks 2026.

Browser identity in 2026: fingerprinting reality

Across 28,412 browsers, 94 countries, January-April 2026 PrivSec Lab panel:

Canvas fingerprint entropy: Chrome 19.4 bits, Safari 17.1, Firefox RFP 8.3, Brave Strict 6.1
WebGL renderer reveals: 92% of Chrome users expose precise GPU + driver
AudioContext fingerprint: persistent across 87% of cross-site sessions
Font enumeration ratio: median 0.43 unique fonts vs panel baseline

Full data: browser fingerprinting state of art 2026.

What this means

If your threat model is targeted: Lockdown Mode is meaningfully better in 2026 than 2022.

If your threat model is routine surveillance: Lockdown addresses one axis (JIT exploits) but not the other (fingerprinting). Browser choice matters more — see privacy browsers compared 2026.