no anti-detect fingerprint setters left on window
None of the known fingerprint setters present, and no cluster of setter-shaped globals beyond the ones the platform defines.
What a detector infers
Anti-detect browsers in the Camoufox family apply a per-context fingerprint through helper functions published on the window object — setNavigatorPlatform(), setScreenDimensions(), setFontSpacingSeed(), setAudioFingerprintSeed(), setSpeechVoices() and about ten more. An automation-side init script calls the ones it needs, and each was trusted to delete itself once called.
That self-destruct only ever covered the setters a given fingerprint actually set: a value the configuration left alone never called its setter, so that name stayed on window for the life of the document, and a launch that registered no init script at all — the documented default of opening the browser and asking for a page — left every one of them behind.
The result is a browser whose entire purpose is to look unremarkable, publishing a set of window properties that no other engine defines. Detection needs no fingerprint analysis, no statistics and no population data: reading typeof window.setFontSpacingSeed is a single expression that names the tool. That is why this is scored critical rather than as a lean. A noisy canvas or an unusual screen size shifts a probability; this is a signature.
The row probes the fifteen published names directly rather than enumerating window, because these are handed out by the DOM resolve hook and can answer typeof without ever appearing in getOwnPropertyNames.
It then counts every remaining setter-shaped global beyond the four the platform itself defines (setTimeout, setInterval, setResizable, setImmediate); three or more is treated as the same surface under different names, so a fork that renames its helpers still reads as anomalous, while one or two are reported and never scored because a page is entitled to define a global called setFoo.
How to resolve it
The setters are configuration API for the automation side, not page API, so they should not outlive the init scripts that consume them. Seal the whole surface once the fingerprint has been applied and before page script runs — a window that starts sealed and is opened only for the duration of the init scripts fails closed, so a launch that never registers an init script offers nothing rather than offering everything.
Leaving each setter to remove itself on call cannot work, because the setters a given configuration never calls are exactly the ones left behind.
Nearby checks in Automation surface
- navigator.webdriver does not assert WebDriver control
webdriver-offThis check is intentionally one-way. The WebDriver specification defines navigator.webdriver as the browser's assertion that it is under… - navigator.webdriver is a native prototype getter returning false
webdriver-descriptor-integrityRather than reading the value, this check inspects the property's shape: it requires a getter on Navigator.prototype whose… - no Selenium / Puppeteer / Playwright globals
automation-globalsThis check tests a fixed list of roughly two dozen known names against both window and document (Selenium's __webdriver_evaluate /… - DevTools Runtime serialization is not active
runtime-enable-leakAn attached DevTools Runtime domain serialises console arguments and reads an Error stack accessor. - No console preview enumerated a prototype-chain Proxy
console-preview-proxy-trapDevTools has to look inside an object to show it to you, and in JavaScript looking inside an object is an observable act. - No Puppeteer / Playwright sourceURL marker
sourceurl-leakPuppeteer and Playwright evaluation labels can appear in main-world Error stacks. - No controller code crossed the main-world canary
main-world-executionAn early DOM canary records main-world calls, but page code and extensions can also call it, so this is contextual. - No exposed Puppeteer / Playwright binding
exposed-binding-leaksExposed functions leave Playwright/Puppeteer registries, prefixes, source text, or __installed markers.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family antidetect-fingerprint-setters belongs to.