nonexistent navigator properties return undefined
Check id navigator-proxy-honeypot
What an ordinary browser yields
navigator.rml and the other invented names all read back as undefined, and `'rml' in navigator` is false.
What a detector infers
This reads five navigator property names that exist on no browser — rml, ln, rnd, webdriverPatched and __clearcoteProbe — and additionally evaluates `'rml' in navigator`. The correct answer on every real engine is undefined for all five, and false for the `in` test, so the check has zero false-positive surface by construction: it fails only if something answers a question no browser can answer. A navigator backed by a Proxy with a catch-all get (or has) trap responds to arbitrary keys and thereby reports its own existence, independently of how plausible any real property's value is. The name rml is not arbitrary: it appears in a decompiled commercial detector VM among genuine navigator reads, which is why it is included verbatim.
How to resolve it
Never back navigator with a Proxy that answers arbitrary keys. Spoof individual properties by overriding only the specific accessors you intend to change — ideally at the engine level — so unknown keys fall through to undefined and `in` reports them absent, as on a stock browser.
Read in the wild by
Kasada
Asks for navigator properties that do not exist, so an over-eager Proxy answers for something real browsers have never had. It also runs an explicit Proxy-invariant probe.
navigator_wireless_devices (no such API), navigator_fake_ln, navigator_fake_rnd, navigator_fake_rml, navigator_fake_v, window_proxy_check
Kasada ips.js teardown — the full 427-probe listEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Native function integrity
- key native functions are untampered (toString + no prototype)
native-integrityThis runs a battery over roughly forty engine-owned callables — canvas, WebGL, navigator, iframe, shadow-DOM and fetch natives, plus the JS… - a fresh iframe (contentWindow) matches the main realm
iframe-coherenceThe check appends a hidden same-origin iframe to documentElement and reads its contentWindow — a brand-new JavaScript realm with its own… - Worker navigator matches the main thread
worker-navigator-coherenceA Blob-URL Worker is spawned and reports its own navigator.platform, navigator.hardwareConcurrency, navigator.webdriver and… - page-world natives that extensions commonly wrap
page-world-wrappersThis probe stringifies window.fetch and window.Request and asks whether each still renders as native code, then checks whether document… - native methods enforce their C++ receiver check
native-brand-checksTwo native methods are invoked with their own bare prototype as the receiver… - iframe srcdoc/src/contentWindow live on the prototype
iframe-srcdoc-placementA fresh <iframe> is created with document.createElement and inspected for own property descriptors on srcdoc, src and contentWindow. - Element.attachShadow untampered (shape + closed/open behaviour)
shadow-dom-integrityThe check reads Element.prototype.attachShadow four ways and asserts they agree: its name is "attachShadow", its length (declared parameter… - Math.random / crypto.getRandomValues native and high-entropy
rng-integrityThe check verifies that Math.random is the engine's native generator and that its output is high-entropy.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Native function integrity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Native function integrity — the family navigator-proxy-honeypot belongs to.