navigator.plugins is a real IDL collection, not a JavaScript object
Check id plugins-idl-index-wraparound
What an ordinary browser yields
plugins.item(2^32 + 1) returns the same object as plugins.item(1) — the modular index reduction a real PluginArray performs, matching the control NodeList in the same realm.
What a detector infers
A real navigator.plugins is a PluginArray — a C++-backed IDL collection — and its indexed getter runs the Web IDL unsigned-long conversion, so item(2^32 + 1) is item(ToUint32(2^32+1)), which is item(1). A spoof that replaces plugins with a plain JavaScript object or array to control its contents loses that wraparound, because a JavaScript object property access performs no modular reduction. So asking for a deliberately out-of-range index tells a genuine binding apart from a fabricated one, and it does so without reading a single plugin name — it is a question about the nature of the collection, not its contents. The check is control-gated so it can never misfire: before judging plugins it confirms that this realm binding layer wraps at all, using a NodeList nobody has any reason to spoof (querySelectorAll over html, head and body). If that control does not wrap, the check declines rather than holding plugins to a rule this engine does not follow. It is scored warn rather than critical for one honest reason: a legitimate page-world fingerprinting extension can also replace plugins with a JavaScript object, so the signal means this is not the native collection, not this is a bot.
How to resolve it
Do not replace navigator.plugins with a JavaScript array or object. A real PluginArray is a C++ IDL collection whose indexed getter reduces the index modulo 2^32, and a JavaScript stand-in cannot reproduce that. A plugin list that must be presented has to come from the browser, not from page script.
Read in the wild by
CloakBrowser issues
The tracker discusses JS-layer plugin spoofing being distinguishable from the native PluginArray binding — exactly the boundary this probe reads.
CloakHQ/CloakBrowser #208, #292 (JS-layer collection spoofing)
CloakHQ/CloakBrowser#208Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- no notifications-permission headless bug
permissions-notification-bugTwo independent APIs describe the same underlying notification permission: navigator.permissions.query({name:'notifications'}) returns a… - permissions.query is native (arity throw + stack shape)
permissions-query-stackThis probe calls navigator.permissions.query() with exactly zero arguments and inspects the error the native arity check produces. - timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated… - document.hidden agrees with document.visibilityState
document-visibility-coherencedocument.hidden and document.visibilityState are two views of one piece of state, and the specification defines the first in terms of the… - navigator.storage quota is the same in the window and a same-origin worker
storage-quota-worker-vs-mainnavigator.storage.estimate().quota describes one storage partition, and a same-origin worker shares that partition — a single QuotaManager… - performance.timeOrigin + performance.now() reconstructs Date.now()
clock-origin-coherenceA page has two clocks. performance.timeOrigin is the wall-clock moment its timeline began; performance.now() is the monotonic time elapsed… - the gesture that started this audit registered as a real user activation
user-activation-vs-interactionThis audit only runs when you press the Run button, and pressing a button is exactly what grants user activation — by pointer, by Enter or… - user activation only ever appeared after a real input event
activation-without-inputThe row above this one reads navigator.userActivation once and expects it to be true, because the audit is reached by pressing a button.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family plugins-idl-index-wraparound belongs to.