history.replaceState to another origin throws SecurityError
replaceState to another origin throws a DOMException named SecurityError. N/A when no frame can be created (severity: warn).
What a detector infers
history.replaceState may change the URL shown for a document only within its own origin; the HTML standard requires a SecurityError for any URL that would put another origin in the address bar. Every browser enforces it, because a page able to rewrite its URL to another site could impersonate that site. An emulated History — jsdom's, a test double, or a wrapper that records calls instead of passing them to the browser — tends to store the URL and return.
The row calls replaceState with https://example.org/ on the history of a fresh hidden frame, so the audit page's own URL is never touched. A widely deployed CAPTCHA's challenge script makes the same call. Measured on 2026-10-28: SecurityError in Google Chrome 154–156, Chromium 153 and Clearcote r52.
How to resolve it
Leave History to the browser. Wrapping it for instrumentation has to keep the browser's own checks, including this one.
Nearby checks in Automation surface
- The user agent names no headless product
headless-ua-tokenBoth of Chrome's headless modes name themselves in the user agent. - A fresh frame has none of Node's, Deno's, Bun's or Pyodide's globals
runtime-globals-absent-in-fresh-frameA new about:blank frame starts with the browser's own globals and nothing else, because no page script has run in it. process, module… - No automation extension has written its marker into the page
automation-extension-markupSome automation tools announce themselves in the pages they control. - No interface stable Chrome keeps behind a developer switch is exposed
flag-only-surfaces-absentStable Chrome keeps unfinished web platform features behind developer switches, and some of them add global interfaces as soon as the switch… - No debugger client attached to this tab after it loaded
console-replay-trapV8 keeps the console messages a page logs, which is why DevTools can show messages logged before it was opened. - navigator.webdriver does not assert WebDriver control
webdriver-offThis check is intentionally one-way. The WebDriver specification defines navigator.webdriver as the browser's assertion that it is under… - navigator.webdriver is a native prototype getter returning false
webdriver-descriptor-integrityRather than reading the value, this check inspects the property's shape: it requires a getter on Navigator.prototype whose… - No Selenium / Puppeteer / Playwright globals
automation-globalsThis check tests a fixed list of roughly two dozen known names against both window and document (Selenium's __webdriver_evaluate /…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family history-replacestate-cross-origin-throws belongs to.