A popup opened without a user gesture is blocked
window.open without a user gesture returns null (severity: warn).
What a detector infers
Chrome blocks a window.open popup unless the page has a user activation, a click or key press in the last 5 seconds. The switch --disable-popup-blocking turns that off, and the common automation drivers pass it by default. So a page can call window.open without a gesture and see whether it gets a window back. The audit waits until the click that started it has expired, then tries once and closes any window that opens.
Measured on 2 November 2026 on Windows: genuine Chrome 156 blocked it, the same Chrome started with --disable-popup-blocking opened it, and Clearcote under its SDK blocked it. Chrome shows its pop-up-blocked icon in the address bar afterwards; that is the expected result. A site that has been allowed pop-ups in Chrome's settings fails this row, which is why it is a warning.
How to resolve it
Launch without --disable-popup-blocking. Remove it from the driver's default arguments; pages that need a popup can still open one after a click.
Nearby checks in Automation surface
- No controller code crossed the main-world canary
main-world-executionAn early DOM canary records main-world calls, but page code and extensions can also call it, so this is contextual. - No exposed Puppeteer / Playwright binding
exposed-binding-leaksExposed functions leave Playwright/Puppeteer registries, prefixes, source text, or __installed markers. - No global holds an unnamed native function
no-unnamed-native-globalsThe DevTools protocol lets an automation client put a function on the page with Runtime.addBinding, so page code can call back into the… - The page itself arrived over a network protocol
document-arrived-over-networkEvery page keeps a navigation timing entry for its own document. - Content Security Policy is enforced
csp-bypassThe audit excludes data: scripts. Execution despite script-src is direct CSP-bypass behavior. - The browser will not resolve a filesystem path the page invented
synthesized-path-entry-sandboxThis row does not measure a fingerprint. It measures whether the browser will help a page enumerate what is installed on the machine, and it… - No stylesheet is injecting custom properties into every page
injected-root-custom-propertiesA deployed commercial agent reads six CSS custom properties from the document's root element and reports true when four or more of them… - window.chrome present for a Chrome UA
chrome-objectThis is a cross-check, not a probe of window.chrome's contents: it first decides whether the browser claims to be Chrome (a Chrome/ token in…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family popup-blocked-without-gesture belongs to.