Above I listed a bunch of things which would help narrow down browser version, but that's hopeless anyway -- an adversary will probably be able to figure out your rough browser version even if you fake the UA string, and that you're running in anti-fingerprinting mode.

So assuming that's out of scope I think these are probably the big categories:

• Normalize any system information presented to webpage (e.g. remove minor version from UA header, remove OS from UA header, etc)
• Canvas, WebGL, and WebGPU need to be implemented in software in a deterministic way. Similarly any compositing (including stuff like font shaping, SVG rendering, page layout) must be done in software (prevent GPU fingerprinting)
• A fixed font set must be used rather than using the system font set (prevent fingerprinting font enthusiasts)
• The device size / frame size (and position) must be lied about (e.g. rounded to a common resolution or a multiple of 100px), and layout adjusted appropriately (Mozilla calls this "Letterboxing") (prevent fingerprinting psychos who don't run their browser in fullscreen mode).
• Page storage should be disabled or cleared (local / session storage, cookies, service workers, indexeddb, etc) (A cookie by any other name would taste as sweet)
• Caching is a big problem, probably have to disable it entirely (including HTTP caching, HTTP caching at the ISP level*, DNS lookups, favicons, JavaScript compilation cache) (Pesky pesky global state).
• Performance metrics are another big problem. Disabling JavaScript would go a long way here but you probably can't prevent them entirely unless you're prepared to go to unhealthy extremes** (this is like the past 10 years of cutting edge security research so we're doomed)
• Disable any plugins or other customizations which may provide a fingerprint accessible to the webpage (oops it turned out the FBI caught me because I configured my browser to inject pictures of cute bunnies into every webpage).
• And of course IP address, which you presumably want to do something about (proxy?)

That said while I've worked with browsers, I'm not in the biz of fingerprinting or anti-fingerprinting, so there's surely stuff I haven't thought of.

* Actually we should probably just disable non-HTTPS entirely...

** Running under a VM is probably the minimum required to mitigate the chances of cutting-edge side-channel timing attacks from James Bond level adversaries, but at that point maybe you just want a dedicated browsing computer heh. I did chuckle at the idea of someone trying to apply cryptographic constant-time algorithm techniques to writing a browser though.