a Windows CJK font answers to its localized family name as well as its English one
Under a Windows claim on Chromium, every probed CJK face that resolves under its English name also resolves under its localized name, with an identical width.
What a detector infers
Windows fonts carry their family name in more than one language. SimSun is also 宋体, Microsoft YaHei is also 微软雅黑, MS Gothic is also ＭＳ ゴシック, and Malgun Gothic is also 맑은 고딕. DirectWrite matches a family request against every localized name in a font's name table, whatever the UI language. So on a real Windows install both spellings select the same face, and text set in either measures the same width to the last fraction of a pixel.
A browser that shapes its font list with an allowlist of English names breaks this: the English spelling still resolves and the localized one falls back to the generic. This row measures fifteen English and localized pairs that were verified on a Windows 11 host. It asserts only for pairs whose English name is present, requiring the localized name to resolve too, to the same width.
Measured on 2026-09-24: Chrome 153 (normal, headless and zh-CN) and Edge 153 keep every pair coherent. Brave 153 drops every localized name, because its font protection allowlists English names; it is declined through the native navigator.brave check. Firefox is declined as well.
It passed every pair when probed on its own, but in a full audit run it missed three localized Light names, because Gecko loads a font's localized names lazily and the answer depends on when the page asks.
How to resolve it
The font list presented to the page has to behave like the font collection underneath it, and on Windows that collection answers to every language's family name. Filtering by an English allowlist breaks that for every CJK face at once. Present the host's fonts unfiltered, or resolve a requested name to its face before deciding whether to hide it, so both spellings get the same answer.
Declined for Brave, for Firefox and other non-Chromium engines, and for claims other than Windows, which were not measured.
Read in the wild by
CloakBrowser issues
A user compared the v150 binary with genuine Chrome on the same Windows 11 machine. Every localized name was missing (宋体, 微软雅黑, 微軟正黑體, 新宋体, 游ゴシック, 맑은 고딕, ＭＳ ゴシック, ＭＳ Ｐゴシック) while the English names of the same fonts were present. Genuine Chrome detected both spellings.
CloakHQ/CloakBrowser #474 (v150 binary diverges from Chrome for fonts)
CloakHQ/CloakBrowser#474CloakBrowser (measured)
150 and 151 resolve every present English CJK name and none of the localized ones. 152 answers to both, so the allowlist was fixed there. The same 152 build still hides Franklin Gothic Medium from layout while local() loads it (see the row above).
15 pairs on one Windows 11 host. CloakBrowser 150.0.7871.114.3-pro: 10 of 10 present pairs broken. 151.0.7922.108.3-pro: 14 of 14 broken. 146, 148, 152: 0 broken. Chrome 153 (3 modes), Edge 153, Clearcote r27: 0 broken. Brave 153: 15 of 15 broken (declined). Firefox 144: 0 broken in isolation, 3 Light aliases missed in a full audit run (Gecko declined).
CloakBrowser (measured)Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Engine & OS oracles
- the three heap numbers describe a possible heap
jsheap-triplet-orderingThis check replaces a retired one, and the swap is the lesson. - the platform's system font belongs to the operating system claimed
system-font-vs-claimed-osThe CSS2 system-font keywords — caption, icon, menu, message-box, small-caption and status-bar — are resolved by the HOST platform's font… - text layout uses the font scaler of the operating system claimed
text-scaler-vs-claimed-osEvery operating system draws text with its own font scaler: DirectWrite on Windows, Core Text on macOS, FreeType on Linux, Android and… - core Windows fonts that measure as installed also load by name
windows-fonts-load-by-nameA page can ask whether a font is installed in two ways. It can measure: draw a string in the font with a generic fallback and see whether… - a Windows face that loads by name is also visible to text layout
font-loads-by-name-vs-layoutThis is the row above asked in the other direction. A page can learn whether a font is installed by loading it by name, new FontFace(x… - typefaces the claimed OS ships as separate faces measure as separate faces
claimed-os-typefaces-are-distinctA font request is answered by the host's font stack, not by the browser and not by anything the user agent sets, so changing… - the number of font families the page can detect is reported for comparison
font-family-count-vs-claimed-osThe two font rows beside this one ask whether the font layer CONTRADICTS the operating system being claimed. - the rare typefaces deployed collectors probe for are reported beside the claimed OS
rare-face-probe-set-vs-osFont enumeration in a deployed collector is not a sweep of everything installed — it is a short list of deliberately rare faces, chosen…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Engine & OS oracles checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Engine & OS oracles — the family font-localized-alias-vs-english belongs to.