navigator.vendor is the constant the measured engine compiles in
Check id navigator-vendor-vs-engine
What an ordinary browser yields
"Google Inc." on any V8 engine, the empty string on Gecko, "Apple Computer, Inc." on JavaScriptCore — matching the engine measured by the oracle, and identical in a fresh realm.
What a detector infers
navigator.vendor is not a preference or a setting — it is a string constant compiled into the engine. Every V8-based browser reports "Google Inc." without exception: Chrome, Edge, Brave, Opera, Vivaldi, Samsung Internet and Electron all share the value because they all share the engine. Gecko reports the empty string. JavaScriptCore reports "Apple Computer, Inc.", which is why Chrome and Firefox on iOS report it too — on that platform they are WebKit underneath, whatever their name says. Three values, defined by three engines. What makes this worth its slot next to the productSub check is the ANCHOR. productSub gates on the user agent, which is the one thing a spoof always changes; this gates on the engine ORACLE — the RangeError phrasing and Array-source measurement that no UA patch, CDP override or userAgentData shim can reach. So the question it asks is not "does this vendor match the browser you claim to be" but "does this vendor match the engine you provably are", and those are very different questions. The check also compares the value against a fresh realm, which is engine-agnostic and holds regardless: both realms read the constant from the same binary, so an assignment that reaches only the page world is visible immediately. An engine the oracle cannot name is declined rather than guessed at, so this can go quiet but never wrong. The evidence that this is read in the wild is unusually direct: navigator.vendor is a named evasion module in the mainstream stealth plugins — someone thought it was worth patching — and DataDome's captured payloads carry it as a collected field.
How to resolve it
The value is compiled into the engine, so it cannot be chosen independently of the engine running underneath. Setting it to suit a user agent leaves the oracle disagreeing, and the assignment holds only in the realm it was made in — a fresh iframe goes on reading the binary's own constant. If the vendor must read differently, the engine has to be different.
Read in the wild by
DataDome
Ships navigator.vendor verbatim in its payload.
oI5mpq = "Google Inc."
glizzykingdreko/datadome-encryption — tests/original.jsonEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Navigator identity
- the machine delivers no more parallelism than it claims cores
hardware-concurrency-vs-parallelismThe plain hardwareConcurrency row can only ask whether the number looks sane, because no second API reports a core count. - the Keyboard API's presence matches the claimed engine and form factor
keyboard-api-vs-platformThe Keyboard API — navigator.keyboard, with getLayoutMap and lock — ships in desktop Chromium and nowhere else: not in Gecko, not in WebKit… - browser-brand and context hints agree with a fresh realm
brand-hints-vs-realmSome of the cheapest signals to fake are the ones that say which browser this is: navigator.brave exists only in Brave, window.duckduckgo… - location.origin is the serialisation of its own protocol, host and port
location-origin-coherenceAn origin is not stored next to a URL, it is serialised from it: for an http or https document, origin is exactly the scheme, followed by… - navigator.oscpu names the same OS family as the user-agent
ua-oscpu-os-family-coherencenavigator.oscpu is a property only Gecko still exposes — Chromium removed it and WebKit never had it — so this check is silent on every… - a worker resolves the same IANA timezone as the main thread
worker-main-timezone-coherenceA browser has one host timezone, and the specification ties both the main-thread global and every worker global to it, so a real browser… - the keyboard layout maps the OEM keys the way one real Windows layout would
keyboard-layout-single-originA keyboard layout is not a set of independent key mappings — it is one artifact the operating system hands over whole. - navigator.appVersion is the user agent minus its leading token
appversion-vs-useragentnavigator.appVersion is not an independent fact. In Blink and WebKit it is computed from the User-Agent at read time — literally the UA with…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Navigator identity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Navigator identity — the family navigator-vendor-vs-engine belongs to.