- Brief BytePlus veFaaS Browser Analysis
ByteDance’s PaaS/IaaS/SaaS offerings, Volcano Engine (火山引擎) and BytePlus, are both rather similar services under-the-hood, with the former serving domestic China and the latter the rest of the world. They both offer a range of services, including browser automation under Volcano Engine’s Function as a Service (veFaaS).
However, the Chromium they offer isn’t quite stock and instead has some modifications. Inspecting the logs, I found mention of this Docker image: enterprise-public-ap-southeast-1.cr.volces.com/vefaas-public/browser-pool:latest. Curious, I, of course, downloaded it and investigated.
As of writing, the latest version of this image is from September 5th, 2025, and contains two browser versions. The first is a completely standard version of Chromium 136.0.7103.25 (/ms-playwright/chromium-1169/chrome-linux/chrome). However, alongside it and used by default is a version referred to as ‘enhanced’. This is Chromium 117.0.5938.60 (/opt/chromium.org/browser_use/chromium/chrome) and is chosen by enable_enhancement=true.
My interest is in what this ‘enhancement’ is, as I believe it extremely likely that this is an older version of the browser which powers ByteDance’s infamous ByteSpider web crawler/scraper. Comparing to ByteSpider, it matches the Accept header of the ByteSpider-matching subset, which advertises HEIF support not present in standard Chromium (text/html,application/xhtml+xml,application/xml;q=0.9,image/heif,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7).
Chromium 117 ‘enhancement’ contains these instrumentation strings: TTGlobalHeadless/TTHeadless, bytedance/loading, and probe. I assume the ‘TT’ refers to TikTok, which would make sense, as ByteDance is known to operate ‘TikTokSpider’ and uses ‘TT’ in the names of frameworks, APIs, SDKs, and other developer tools. It could also refer to 头条.
If this is of the ByteSpider family, I take it to be an older version, as the TLS ClientHello record is 512 B and X25519 only, while ByteSpider’s has been observed to be 1,722–1,818 B and PQ class, which is in line with more modern versions of Chrome.
It is, of course, possible that this is merely how ByteDance modifies their browsers, and it has no association with ByteSpider at all. More testing is necessary to ascertain whether modern ByteSpider ever includes the forest timing fields seen with the suspicious aocr.org referring crawler/scraper.