no stylesheet is injecting custom properties into every page

A deployed commercial agent reads six CSS custom properties from the document's root element and reports true when four or more of them resolve to anything. No ordinary page declares those names. They are theming variables that a particular browser build writes into the root element of every page it renders, so a non-empty value is that build identifying itself through the style system rather than through anything a fingerprint would capture.

The assertion here generalises past those specific names and does not depend on knowing which product they belong to: on a clean browser, a custom property nobody declared resolves to the empty string, always.

So the probed set is checked together with a control name invented for this audit that could not plausibly be defined anywhere — and if the control comes back non-empty, the computed style is not answering honestly about what is declared, which is a different and worse finding than any particular variable being set. The reason to care is how cheap this is for the other side.

One getComputedStyle call and a handful of property reads: no timing, no rendering, no permission prompt, nothing that looks like fingerprinting at all. It identifies a build directly instead of inferring it, which makes it strictly better than a fingerprint for anyone who can use it.