navigator.plugins is a real IDL collection, not a JavaScript object
plugins.item(2^32 + 1) returns the same object as plugins.item(1) — the modular index reduction a real PluginArray performs, matching the control NodeList in the same realm.
What a detector infers
A real navigator.plugins is a PluginArray — a C++-backed IDL collection — and its indexed getter runs the Web IDL unsigned-long conversion, so item(2^32 + 1) is item(ToUint32(2^32+1)), which is item(1). A spoof that replaces plugins with a plain JavaScript object or array to control its contents loses that wraparound, because a JavaScript object property access performs no modular reduction.
So asking for a deliberately out-of-range index tells a genuine binding apart from a fabricated one, and it does so without reading a single plugin name — it is a question about the nature of the collection, not its contents. The check is control-gated so it can never misfire: before judging plugins it confirms that this realm binding layer wraps at all, using a NodeList nobody has any reason to spoof (querySelectorAll over html, head and body).
If that control does not wrap, the check declines rather than holding plugins to a rule this engine does not follow. It is scored warn rather than critical for one honest reason: a legitimate page-world fingerprinting extension can also replace plugins with a JavaScript object, so the signal means this is not the native collection, not this is a bot.
How to resolve it
Do not replace navigator.plugins with a JavaScript array or object. A real PluginArray is a C++ IDL collection whose indexed getter reduces the index modulo 2^32, and a JavaScript stand-in cannot reproduce that. A plugin list that must be presented has to come from the browser, not from page script.
Read in the wild by
CloakBrowser issues
The tracker discusses JS-layer plugin spoofing being distinguishable from the native PluginArray binding — exactly the boundary this probe reads.
CloakHQ/CloakBrowser #208, #292 (JS-layer collection spoofing)
CloakHQ/CloakBrowser#208Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- the media-session counter runs forward and does not restart
eme-session-counter-monotonicA deployed commercial agent opens a ClearKey media session purely to read its identifier as a number — and then, if that number comes back… - the global object carries every platform global its claimed Chromium major carries
window-globals-vs-baselineThe list of names on the global object is not written by the page — it is installed by the engine when it sets up a realm, from a table… - the element prototype chain matches its claimed Chromium major's
element-surface-vs-baselineA for..in over the document element does not enumerate one object: it walks the whole prototype chain — HTMLElement, Element, Node… - document.hidden agrees with document.visibilityState
document-visibility-coherencedocument.hidden and document.visibilityState are two views of one piece of state, and the specification defines the first in terms of the… - navigator.storage quota is the same in the window and a same-origin worker
storage-quota-worker-vs-mainnavigator.storage.estimate().quota describes one storage partition, and a same-origin worker shares that partition — a single QuotaManager… - performance.timeOrigin + performance.now() reconstructs Date.now()
clock-origin-coherenceA page has two clocks. performance.timeOrigin is the wall-clock moment its timeline began; performance.now() is the monotonic time elapsed… - the gesture that started this audit registered as a real user activation
user-activation-vs-interactionThis audit only runs when you press the Run button, and pressing a button is exactly what grants user activation — by pointer, by Enter or… - user activation only ever appeared after a real input event
activation-without-inputThe row above this one reads navigator.userActivation once and expects it to be true, because the audit is reached by pressing a button.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family plugins-idl-index-wraparound belongs to.