The JS heap ceiling fits the memory the browser reports
With deviceMemory 4 or below, jsHeapSizeLimit stays below 3.5 billion bytes. N/A on Brave, on Android and where performance.memory is absent (severity: warn).
What a detector infers
navigator.deviceMemory and V8's heap ceiling, performance.memory.jsHeapSizeLimit, look unrelated but are computed from the same number: the physical memory the operating system reports to Chrome. deviceMemory rounds it to a power of two — 4 means more than 3 and at most 6 GiB — and V8 sizes its heap at roughly half of physical memory, saturating at about 4.4 billion bytes from 8 GiB upward.
So a deviceMemory of 4 or less caps the heap at about 3.3 billion bytes, and a heap above 3.5 billion beside it cannot come from one machine. Measured on genuine Linux Chrome with the reported memory varied: 3.8 GB gave deviceMemory 4 and a heap of 2.19 billion, 6 GB gave 4 and 3.34 billion, and 7.6 GB gave 8.
In the audit's corpus, the six plausible captures of 4 GB or less all have heaps between 2.17 and 2.25 billion; the nine with deviceMemory 4 beside a heap of 4.3 to 4.4 billion all carry other signs of a spoof, and a deviceMemory override in JavaScript is caught the same way. It is the cross-API complement of device-memory-bounds and jsheap-triplet-ordering, which check each value on its own terms. Brave and Android are excluded.
A browser launched with --js-flags=--max-old-space-size raises the ceiling on purpose and will trip it.
How to resolve it
Report deviceMemory from the machine's real memory, or run on a machine with the memory being claimed. Overriding deviceMemory alone leaves V8's heap ceiling sized from the real figure, and no page-level override moves that.
Nearby checks in Network & WebRTC
- Every server-reflexive address is one the STUN server actually handed out
srflx-was-seen-by-stunA server-reflexive candidate exists only after a STUN server received a binding request from that public address and replied with it. - Emoji come from the claimed OS's emoji font
emoji-font-vs-osEmoji are drawn from the operating system's colour emoji font, and the fonts differ in a way measureText can see without rendering a pixel. - Canvas text is anti-aliased the way the claimed OS rasterises it
glyph-aa-levels-vs-osCanvas text is rasterised by the platform's font engine, and the engines leave different fingerprints in the alpha channel. - The default monospace font is the claimed OS's
monospace-default-vs-osThe generic monospace family resolves to a font the platform chooses. - The address WebRTC exits from matches the address this page was served to
webrtc-ip-vs-connectionThis is the one check on this page that cannot be answered from inside the page, and the only one that makes a network call. - Relay-forced WebRTC exits the same address this page arrived from
webrtc-turn-egressEvery other WebRTC check on this page reads what the browser is willing to show it. - Host candidates use an mDNS hostname rather than a literal LAN address
webrtc-mdns-hostWhen WebRTC enumerates the ways a peer might reach you, it offers host candidates describing your machine's own network interfaces. - ICE gathering offers at least one candidate on a working network
webrtc-gathering-suppressedThe other WebRTC rows on this page read what the candidates SAY.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Network & WebRTC checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Network & WebRTC — the family heap-ceiling-vs-device-memory belongs to.