chrome.runtime is absent or built from real extension bindings
chrome.runtime is absent, or its sendMessage and connect have no prototype and throw TypeError under new (severity: warn).
What a detector infers
On an ordinary web page, Chrome defines window.chrome but not chrome.runtime: that appears only when an installed extension declares the site in externally_connectable, and then sendMessage and connect are extension bindings, native methods that cannot be called with new and have no prototype property.
Stealth plugins that rebuild chrome.runtime to look like a real Chrome usually write those methods as ordinary JavaScript functions, which do have a prototype and can be constructed. The audit reports chrome.runtime's absence as a pass, and asserts only when sendMessage or connect exists. Measured on 2 November 2026: genuine Chrome 156 with a fresh profile has no chrome.runtime on any page tried, including Google's own sites, and neither does Clearcote.
How to resolve it
Do not add a chrome.runtime object from script. An ordinary page does not have one; if one is needed, it has to come from a real extension.
Nearby checks in Automation surface
- The browser will not resolve a filesystem path the page invented
synthesized-path-entry-sandboxThis row does not measure a fingerprint. It measures whether the browser will help a page enumerate what is installed on the machine, and it… - No stylesheet is injecting custom properties into every page
injected-root-custom-propertiesA deployed commercial agent reads six CSS custom properties from the document's root element and reports true when four or more of them… - window.chrome present for a Chrome UA
chrome-objectThis is a cross-check, not a probe of window.chrome's contents: it first decides whether the browser claims to be Chrome (a Chrome/ token in… - window.chrome.* helpers are native (not JS stubs)
chrome-native-stubsWhere the previous check asks whether window.chrome exists, this one asks whether its members are genuine. - window.external is shaped the way the engine generates it
window-external-shapeA deployed commercial agent lists the absence of this object among its own named failure messages, which means it treats window.external… - No notifications-permission headless bug
permissions-notification-bugTwo independent APIs describe the same underlying notification permission: navigator.permissions.query({name:'notifications'}) returns a… - permissions.query is native (arity throw + stack shape)
permissions-query-stackThis probe calls navigator.permissions.query() with exactly zero arguments and inspects the error the native arity check produces. - Timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family chrome-runtime-not-scripted belongs to.