Patchright is an open-source fork of Playwright that patches the library's own source code — not just the page's JavaScript environment — to suppress the CDP-protocol-level tells covered in this glossary's CDP Detection entry, including the Runtime.enable getter leak, stale automation bindings, and non-trusted input events that a JavaScript-only stealth plugin can mask on the page but can't touch at the control-channel level where they actually originate.
A library like playwright-stealth works by injecting JavaScript into the page after launch — overriding navigator.webdriver, patching canvas/WebGL outputs, hiding automation-specific window properties. That fixes signals visible from inside the page's own JS environment, but it runs too late and at the wrong layer to touch anything originating in the CDP control channel itself, like the Runtime.enable getter leak: that leak fires because of how Chrome serializes objects across the CDP WebSocket, not because of anything a page-injected script can intercept.
Patchright instead forks Playwright's own source and rebuilds the parts of the library that talk to Chromium over CDP, so the domains that cause the leaky side effects are never enabled the way they are in stock Playwright, or their side effects are suppressed before they ever reach a detectable page script. It also removes several of Playwright's own automation markers that a page can otherwise use to distinguish a Playwright-driven session from a hand-opened Chrome window.
Patching at this layer closes the CDP-detection class of tells, but it doesn't replace proxy IP quality, TLS/TCP fingerprint consistency, or the deep canvas/WebGL fingerprinting resistance an enterprise-tier anti-bot vendor checks for — those remain separate problems a patched browser alone doesn't fix, the same caveat that applies to every tool in the anti-detect-browser category.
Being a fork carries an ongoing cost: every upstream Playwright release can change the exact code Patchright patches, so maintainers have to rebase it release over release, with no guaranteed SLA on how fast that happens — a real operational risk for anyone pinning a scraping stack directly to it rather than through a managed service that tracks the rebase.
How Crawlora handles this
Crawlora's browser-rendering layer runs source-patched, continuously rebased engines in this same family internally, so a request gets the CDP-leak-closing behavior Patchright targets without your own stack needing to track and rebase the patch against every new Playwright release yourself.
Glossary
FAQ
It's a drop-in fork, not a separate framework — same API surface, source-patched to close CDP-detection leaks, so existing Playwright scripts generally work against it with minimal changes.
No — it closes the CDP control-channel class of tells, like the Runtime.enable leak and related automation bindings, not proxy-IP reputation, TLS/TCP fingerprint mismatches, or enterprise-tier canvas/WebGL fingerprinting, which need separate handling.
playwright-stealth patches the page's JavaScript environment after the browser launches. Patchright patches Playwright's own source so the CDP commands that cause detectable side effects are never issued the way stock Playwright issues them, closing a gap a page-level script can't reach.
Beyond Patchright, Crawlora's own docs cover the rest of the stack — browse the APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.