How I Hacked Chrome’s Dino Game: Uncovering Hidden Global Variables

On a sunny weekend, I opened Chrome to watch two episodes of Rick and Morty, only to see the "No internet" message and the hidden Dino game.

Curious about how the game is implemented, I opened the console and inspected the global variables, finding 239 entries, most unrelated to the game.

To isolate the developer‑defined globals, I created a fresh window (or an iframe) and compared its window object with the current one, filtering out the common properties.

This revealed 45 extra globals injected by Chrome’s front‑end engineers, of which 43 were potential candidates for the Dino game.

After discarding two variables added by the React DevTools extension, I examined the remaining objects and identified the Runner constructor.

Inspecting Runner.prototype showed a gameOver method and a setSpeed method; I overwrote gameOver with an empty function to prevent the dinosaur from dying.

The game instance is stored in the instance_ property of the Runner object, allowing direct manipulation of the dinosaur’s speed via instance_.setSpeed(...).

By executing these snippets in the console, I could control the Dino game’s behavior without modifying any source files.