No controller code crossed the main-world canary
No unexplained canary call.
What a detector infers
An early DOM canary records main-world calls, but page code and extensions can also call it, so this is contextual.
How to resolve it
Use an isolated world for controller helpers.
Nearby checks in Automation surface
- no anti-detect fingerprint setters left on window
antidetect-fingerprint-settersAnti-detect browsers in the Camoufox family apply a per-context fingerprint through helper functions published on the window object… - DevTools Runtime serialization is not active
runtime-enable-leakAn attached DevTools Runtime domain serialises console arguments and reads an Error stack accessor. - No console preview enumerated a prototype-chain Proxy
console-preview-proxy-trapDevTools has to look inside an object to show it to you, and in JavaScript looking inside an object is an observable act. - No Puppeteer / Playwright sourceURL marker
sourceurl-leakPuppeteer and Playwright evaluation labels can appear in main-world Error stacks. - No exposed Puppeteer / Playwright binding
exposed-binding-leaksExposed functions leave Playwright/Puppeteer registries, prefixes, source text, or __installed markers. - Content Security Policy is enforced
csp-bypassThe audit excludes data: scripts. Execution despite script-src is direct CSP-bypass behavior. - the browser will not resolve a filesystem path the page invented
synthesized-path-entry-sandboxThis row does not measure a fingerprint. It measures whether the browser will help a page enumerate what is installed on the machine, and it… - no stylesheet is injecting custom properties into every page
injected-root-custom-propertiesA deployed commercial agent reads six CSS custom properties from the document's root element and reports true when four or more of them…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family main-world-execution belongs to.