“The vulnerability uses information about installed apps on your computer to assign you a permanent unique identifier even if you switch browsers, use incognito mode, or use a VPN.”
A web page asks your browser whether apps like Skype are installed, one custom URL scheme at a time. The list of yes and no answers is a fingerprint. It survives incognito, VPNs and switching to Tor. The company that found it sells browser fingerprinting, so it knows exactly how valuable this is.