mimeTypes are consistent with navigator.plugins
Check id plugins-mimetypes
What an ordinary browser yields
Every mimeType maps back to a plugin object that is present in navigator.plugins — a fully closed graph.
What a detector infers
This walks `navigator.mimeTypes`, and for each entry reads `.enabledPlugin` and checks that the exact object is present in a Set built from `navigator.plugins`. It counts entries whose enabledPlugin is null or is an object absent from the plugin list. This tests object identity, not string equality: in real Chrome the two collections are two views over one internal registry, so every mimeType's enabledPlugin is necessarily the same object instance found in navigator.plugins. Spoofs that fabricate the two arrays independently — a common way to 'fill in' plugins — produce entries that point at nothing, or at plugin objects that do not appear in the list. N/A when there are no mimeTypes to check.
How to resolve it
Do not synthesise navigator.plugins and navigator.mimeTypes as separate JS arrays. Let the real plugin registry populate both, so the cross-references resolve to the same objects; if you must present a plugin set, it has to be wired at the engine level where both views share one backing store.
Read in the wild by
PerimeterX / HUMAN
Brand-checks navigator.mimeTypes.toString() against "[object MimeTypeArray]" and navigator.plugins.toString() against "[object PluginArray]", and ships mimeTypes.length in the same payload as the resolved plugin name list.
main.min.js `CE(){…return t[198]=hU.mimeTypes&&hU[hQ(894)].toString(),t[198]===hQ(895)||new RegExp(hQ(896),"i")[hQ(236)](t[198])}` where hU=navigator, hQ(894)='mimeTypes', hQ(895)='[object MimeTypeArray]', hQ(896)='MSMimeTypesCollection' → payload field "OSUMb39IDFQ=" = true; the plugins twin CB() runs `gQ=hU.plugins[hQ(247)]()` then `gQ===hQ(892)||"[object MSPluginsCollection]"===gQ||gQ===hQ(893)` with hQ(892)='[object PluginArray]', hQ(893)='[object HTMLPluginsCollection]'; `t[0]["ViZjLBNDZBo="]=hU.mimeTypes&&hU.mimeTypes.length||-1` = 2, shipped alongside "T386NQoaPg4=" = ["PDF Viewer","Chrome PDF Viewer","Chromium PDF Viewer","Microsoft Edge PDF Viewer","WebKit built-in PDF"]
CreepJS
CreepJS, an open-source research demo rather than a production detector, walks the plugins/mimeTypes graph in both directions in `getPluginLies`: it maps each mimeType's `enabledPlugin` back against the plugin list to decide which plugin names it still trusts, and separately emits a "missing mimetype" lie when a plugin's first entry is not a genuine `MimeType` instance and an "invalid mimetype" lie when a plugin's mimetype is absent from `navigator.mimeTypes`.
src/lies/index.ts `getPluginLies(plugins: PluginArray, mimeTypes: MimeTypeArray)`: `const mimeTypeEnabledPlugins = excludeDuplicates(mimeTypesList.map((mimeType) => mimeType.enabledPlugin))` narrows `trustedPluginNames` (seeded from `pluginsOwnPropertyNames`); `lies.push('missing mimetype')` fires when `Object.getPrototypeOf(plugin[0]).constructor.name == 'MimeType'` fails; `lies.push('invalid mimetype')` fires when a plugin's `mimetype.type` is not in `trustedMimeTypes` (seeded from `mimeTypesOwnPropertyNames`)
Kasada
Reads the plugin list, its descriptors and the MIME-type table.
window_plugins_descriptor, window_plugins_list, navigator_plugins, navigator_mime_types, iframe_plugins_descriptor
ips.js 427-probe teardown (emro.cat, Apr 2026)
DataDome
Ships the resolved plugin name list.
l0GauR = "PDF Viewer,Chrome PDF Viewer,Chromium PDF Viewer,Microsoft Edge PDF Viewer,WebKit built-in PDF"
glizzykingdreko/datadome-encryption — tests/original.jsonAkamai
Lists plugin enumeration and MIME types as browser-fingerprint signals.
signal_categories.md - 1. Browser Fingerprint - Plugin enumeration
Edioff/akamai-analysis — signal_categories.mdEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Environment & locale
- timezone is not UTC
timezone-not-utcThe check resolves the Intl zone and fails only when it is exactly 'UTC' or 'Etc/UTC'. - IANA zone offset matches the JS clock offset (incl. across DST)
timezone-offset-coherenceThis is a two-source cross-check on the same fact. It takes the resolved IANA zone, formats the current instant through Intl.DateTimeFormat… - navigator.plugins is consistent with the PDF viewer
has-pluginsAn empty navigator.plugins is only meaningful when it contradicts something else, and this check is written to respect that. - navigator.pdfViewerEnabled is true
pdf-viewerA direct read of navigator.pdfViewerEnabled. It is N/A when the property is not exposed at all, passes when true, and is marked false… - proprietary codecs (H.264 / AAC) present for a Chrome UA
codec-supportThe check calls canPlayType on a video and audio element for H.264 ('avc1.42E01E') and AAC ('mp4a.40.2'), plus MP4/WebM/Ogg for context, and… - Blink-only Web APIs present for a Chrome UA
blink-web-apisWhen the UA matches Chrome/\d+ and the page is a secure context, this probes four Blink-only surfaces: navigator.connection… - CSS feature support matches the engine (Blink for a Chrome UA)
css-engine-surfaceFor any UA containing 'Chrome/', this requires CSS.supports('-webkit-app-region', 'drag') to be true and the Gecko markers — MozAppearance… - every Intl constructor resolves the same locale
intl-locale-coherenceEvery Intl constructor — NumberFormat, DateTimeFormat, PluralRules, Collator — resolves its locale through the same underlying ICU data, so…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Environment & locale checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Environment & locale — the family plugins-mimetypes belongs to.