browser-brand and context hints agree with a fresh realm
Check id brand-hints-vs-realm
What an ordinary browser yields
brave, duckduckgo and isSecureContext report identically in the page and in a fresh realm. globalPrivacyControl is shown but deliberately not asserted: no Chromium ships it natively, so on Chrome a page-world-only GPC means an extension defined it — DuckDuckGo Privacy Essentials alone has millions of users — and an extension ADDING a property is ordinary, exactly as it is for globals.
What a detector infers
Some of the cheapest signals to fake are the ones that say which browser this is: navigator.brave exists only in Brave, window.duckduckgo only in DuckDuckGo's browser, and isSecureContext reflects how the page was loaded. All three are trivially assignable on the page's navigator — and all four are read from the browser itself by a realm the browser builds fresh, which is why this check asks a new iframe the same four questions. A brand hint that exists in one realm of a browser and not in another is a strictly stronger signal than the brand hint ever was: it does not merely fail to prove the browser is Brave, it proves something is adding the property after the fact. The same holds in reverse for a hint that was deleted to hide a browser's identity.
How to resolve it
Do not add or remove brand properties on the page's navigator. A fresh realm gets them from the browser and will keep answering honestly, so the edit holds only in the realm you touched — and the disagreement it creates is louder than the value you were trying to change.
Read in the wild by
Kasada
Probes every browser-brand hint twice — once in the page and once in a fresh iframe — which only pays off if a hint can be present in one realm and absent in the other.
window_brave_check / iframe_brave_check, window_duckduckgo / iframe_duckduckgo, window_global_privacy_control / iframe_global_privacy_control, window_is_secure_context / iframe_is_secure_context
Kasada ips.js teardown — the full 427-probe listEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Navigator identity
- navigator.deviceMemory is a power-of-two spec value
device-memory-boundsnavigator.deviceMemory does not report actual RAM — the spec requires the UA to quantise it to a coarse power-of-two rung before exposing… - navigator.hardwareConcurrency is plausible
hardware-concurrencyThis is an info-severity observation, not a scored failure — it reports navigator.hardwareConcurrency and only notes whether the value is an… - the machine delivers no more parallelism than it claims cores
hardware-concurrency-vs-parallelismThe plain hardwareConcurrency row can only ask whether the number looks sane, because no second API reports a core count. - the Keyboard API's presence matches the claimed engine and form factor
keyboard-api-vs-platformThe Keyboard API — navigator.keyboard, with getLayoutMap and lock — ships in desktop Chromium and nowhere else: not in Gecko, not in WebKit… - location.origin is the serialisation of its own protocol, host and port
location-origin-coherenceAn origin is not stored next to a URL, it is serialised from it: for an http or https document, origin is exactly the scheme, followed by… - navigator.vendor is the constant the measured engine compiles in
navigator-vendor-vs-enginenavigator.vendor is not a preference or a setting — it is a string constant compiled into the engine. - navigator.oscpu names the same OS family as the user-agent
ua-oscpu-os-family-coherencenavigator.oscpu is a property only Gecko still exposes — Chromium removed it and WebKit never had it — so this check is silent on every… - a worker resolves the same IANA timezone as the main thread
worker-main-timezone-coherenceA browser has one host timezone, and the specification ties both the main-thread global and every worker global to it, so a real browser…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Navigator identity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Navigator identity — the family brand-hints-vs-realm belongs to.