page-world natives that extensions commonly wrap
Check id page-world-wrappers
What an ordinary browser yields
An ordinary browser with no extensions leaves fetch, Request and document's methods untouched; with extensions installed, entries here are normal.
What a detector infers
This probe stringifies window.fetch and window.Request and asks whether each still renders as native code, then checks whether document carries its own createElement, querySelector or addEventListener descriptors shadowing the prototype chain (createElement and querySelector resolve via Document.prototype, addEventListener via EventTarget.prototype). These are the page-world surfaces ordinary browser extensions legitimately wrap — ad blockers, wallets, userscript managers and AI helpers all hook fetch and shadow document methods — so a hit here does not by itself distinguish an instrumented page from a normal user's browser. That is exactly why this check is severity 'info': it is contextual, never scored, and its pass value is either true (nothing wrapped) or null (something wrapped), never false. It is reported because an operator running a clean automation profile with no extensions should expect an empty list, and because a JS-injection stealth layer surfaces in the same place.
How to resolve it
Nothing to fix if you are running extensions — this is informational and does not affect the score. On a clean automation profile the list should be empty; if it isn't, something in your stack (or a preload/init script) is wrapping fetch, Request or shadowing document methods in the page world.
Read in the wild by
Kasada
It reads the own property descriptor for createElement on the document instance — the shadowing slot, not Document.prototype — and stringifies its value into the payload field 'ce'.
probes.txt:100 `document_create_element` (corroborated at blog.txt:680, batch 14 slot 342); 2.txt:246-248 — `Object.getOwnPropertyDescriptor(globalThis["document"], "createElement")`, value stringified via String.prototype.toString into field 'ce'. This is the only read of document's own createElement descriptor in the payload; all 19 other createElement occurrences construct elements.
Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Native function integrity
- navigator props resolve via native prototype getters
navigator-descriptorsFor deviceMemory, hardwareConcurrency, language, languages and platform, the check reads the property descriptor twice. - key native functions are untampered (toString + no prototype)
native-integrityThis runs a battery over roughly forty engine-owned callables — canvas, WebGL, navigator, iframe, shadow-DOM and fetch natives, plus the JS… - a fresh iframe (contentWindow) matches the main realm
iframe-coherenceThe check appends a hidden same-origin iframe to documentElement and reads its contentWindow — a brand-new JavaScript realm with its own… - Worker navigator matches the main thread
worker-navigator-coherenceA Blob-URL Worker is spawned and reports its own navigator.platform, navigator.hardwareConcurrency, navigator.webdriver and… - nonexistent navigator properties return undefined
navigator-proxy-honeypotThis reads five navigator property names that exist on no browser — rml, ln, rnd, webdriverPatched and __clearcoteProbe — and additionally… - native methods enforce their C++ receiver check
native-brand-checksTwo native methods are invoked with their own bare prototype as the receiver… - iframe srcdoc/src/contentWindow live on the prototype
iframe-srcdoc-placementA fresh <iframe> is created with document.createElement and inspected for own property descriptors on srcdoc, src and contentWindow. - Element.attachShadow untampered (shape + closed/open behaviour)
shadow-dom-integrityThe check reads Element.prototype.attachShadow four ways and asserts they agree: its name is "attachShadow", its length (declared parameter…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Native function integrity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Native function integrity — the family page-world-wrappers belongs to.