permissions.query is native (arity throw + stack shape)
Check id permissions-query-stack
What an ordinary browser yields
Zero-arg permissions.query() rejects with a TypeError whose stack contains no forwarder frames.
What a detector infers
This probe calls navigator.permissions.query() with exactly zero arguments and inspects the error the native arity check produces. Two outcomes are informative. If nothing throws or rejects at all, the native arity check is simply gone, which means query is a JavaScript replacement rather than the engine binding. If an error does arrive, the check reads its stack and looks for .apply or Reflect.apply frames — a JS forwarder wrapping the native function leaves those frames behind because V8 renders the forwarding call in the stack trace it builds. The inference is reliable because the stack is generated by the engine at throw time, not by the wrapper, so a hook that faithfully fakes Function.prototype.toString still shows the forwarder here. Severity is warn, and the check is scored only on Blink with navigator.permissions present; otherwise it reports N/A.
How to resolve it
Don't wrap navigator.permissions.query in JavaScript. If the permission response needs to differ, change it at the engine level rather than installing a JS function that forwards to the native one via .apply — faking toString does not remove the forwarder frame from the arity error's stack.
Read in the wild by
Kasada
Probes the Permissions API.
permissions_query
ips.js 427-probe teardown (emro.cat, Apr 2026)
Akamai
Lists Permissions API behaviour under headless indicators.
signal_categories.md - 6. JavaScript Environment - Headless indicators: `Permissions` API behavior
Edioff/akamai-analysis — signal_categories.mdEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- Content Security Policy is enforced
csp-bypassThe audit excludes data: scripts. Execution despite script-src is direct CSP-bypass behavior. - window.chrome present for a Chrome UA
chrome-objectThis is a cross-check, not a probe of window.chrome's contents: it first decides whether the browser claims to be Chrome (a Chrome/ token in… - window.chrome.* helpers are native (not JS stubs)
chrome-native-stubsWhere the previous check asks whether window.chrome exists, this one asks whether its members are genuine. - no notifications-permission headless bug
permissions-notification-bugTwo independent APIs describe the same underlying notification permission: navigator.permissions.query({name:'notifications'}) returns a… - timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated… - document.hidden agrees with document.visibilityState
document-visibility-coherencedocument.hidden and document.visibilityState are two views of one piece of state, and the specification defines the first in terms of the… - navigator.plugins is a real IDL collection, not a JavaScript object
plugins-idl-index-wraparoundA real navigator.plugins is a PluginArray — a C++-backed IDL collection — and its indexed getter runs the Web IDL unsigned-long conversion… - navigator.storage quota is the same in the window and a same-origin worker
storage-quota-worker-vs-mainnavigator.storage.estimate().quota describes one storage partition, and a same-origin worker shares that partition — a single QuotaManager…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family permissions-query-stack belongs to.