the codec matrix is identical in a fresh realm
Check id codec-surface-vs-realm
What an ordinary browser yields
Every codec answer identical across realms, including the empty answer for the deliberately bogus MIME type.
What a detector infers
canPlayType answers come from the media stack compiled into the browser, and the shape of that matrix is genuinely informative: branded Chrome ships proprietary decoders (H.264, AAC) that a bare Chromium build simply does not have, so the pattern of probably/maybe/unsupported across forty-odd MIME strings describes the binary. This check asks the whole matrix — WAV, MP3, AAC, FLAC, Opus, Vorbis, Theora, VP8, VP9, AV1, H.264 at several profiles, HEVC, MP2T, 3GPP, Matroska, QuickTime, and a deliberately bogus type — in both the page and a fresh realm, and requires every answer to match. A decoder cannot exist in one realm of a browser and not another. The bogus MIME string is included on purpose: a real media stack answers the empty string for a codec it has never heard of, and something synthesising answers has to decide what to say about a codec that does not exist. Kasada asks roughly forty-five canPlayType questions, which is more of its budget than it spends on WebGL.
How to resolve it
Codec support is a property of the build. If the matrix must look different — the usual reason is that a bare Chromium lacks the proprietary decoders branded Chrome has, which is itself visible — use a build that actually has them rather than rewriting canPlayType, which only holds in the realm you patched.
Read in the wild by
CreepJS
Probes video/audio codec support as part of its media fingerprint.
src/media/index.ts — mimeTypes / canPlayType matrix
CreepJS (abrahamjuliot/creepjs)Kasada
Enumerates a large canPlayType matrix — about 45 probes, more than it spends on WebGL — because the answers come from the codecs compiled into the build.
audio_wav, audio_aac, audio_ogg_vorbis, video_mp4_avc1, video_webm_vorbis_vp9, video_ogg_theora, video_mp4_bogus, … (45 total)
Kasada ips.js teardown — the full 427-probe listEvery attribution traces to a published artifact. See the sources and their limits.
Other checks in Capability surfaces
- the device-API family is present or absent as a unit
device-api-family-coherenceWeb Bluetooth, WebUSB, WebSerial and WebHID are one family on Chromium desktop - the same secure-context gating, the same desktop platforms… - Firefox resistFingerprinting announces itself when enabled
firefox-resist-fingerprinting-identifiableFirefox's privacy.resistFingerprinting substitutes CONSTANTS rather than randomness, and a constant is itself a fingerprint. - the CSS feature surface is identical in a fresh realm
css-surface-vs-realmWhich CSS properties, values and selectors an engine understands is decided when the browser is compiled. - device-level media features are identical in a fresh realm
media-surface-vs-realmMedia features are answered by the layout engine rather than by the JavaScript properties that describe the same machine, which is what… - supported <input> types are identical in a fresh realm
input-surface-vs-realmAssigning an unrecognised type to an <input> element does not throw — the element silently falls back to reporting type "text". - emoji advance widths are identical in a fresh realm
emoji-surface-vs-realmEmoji do not render from the page's fonts but from a platform font supplied by the operating system — Segoe UI Emoji on Windows, Apple Color… - the Web Animations surface is identical in a fresh realm
animation-surface-vs-realmThe Web Animations API exposes a small, precisely specified surface: whether Element.animate exists, whether the timeline and KeyframeEffect… - the platform theme resolves the CSS system colours coherently
system-colors-vs-platformThe CSS system-colour keywords — Highlight, HighlightText, Canvas, CanvasText, ButtonFace, ButtonText, GrayText and their newer siblings…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Capability surfaces checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Capability surfaces — the family codec-surface-vs-realm belongs to.