Skip to content
All fingerprint checks
Input & behaviour

Every raw pointer update carries at least its own sample

Pim· Clearcote Research 2 min readCheck id rawupdate-carries-its-sample

Every mouse pointerrawupdate's getCoalescedEvents() holds at least one sample. N/A outside secure contexts, on non-Chromium engines and when no rawupdate was observed (severity: warn).

What a detector infers

pointerrawupdate fires for each pointer report as it arrives, without waiting for the next frame, and Chrome builds each one from a real input event. When several reports are merged into one rawupdate, getCoalescedEvents() lists all of them; when there is only one, it lists that one. Either way the list holds at least the event itself: main_thread_event_queue.cc creates the rawupdate from an input event, and the coalesced list is built from the events merged into it.

A pointerrawupdate whose getCoalescedEvents() is empty therefore had no input event behind it — it was manufactured, between the real ones, by whatever is generating the input. Measured on genuine Chrome receiving input through the DevTools protocol: 82 of 82 rawupdates carried exactly one sample. The row needs a secure context, where pointerrawupdate exists, and a listener registered before input arrives.

High-polling-rate mice have not been measured yet; by the source they produce more samples per rawupdate, never fewer than one. Where input-coalescing-vs-hardware reports how many samples moves carry, this row asserts the one count that cannot occur: zero.

How to resolve it

Deliver input as input events through the browser's input pipeline, one per report, rather than synthesising extra pointerrawupdate events between them. An event the browser built from real input always lists itself.

What is behavioural bot detection?

Nearby checks in Input & behaviour

See all 13 checks in Input & behaviour
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Input & behaviour checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Input & behaviour — the family rawupdate-carries-its-sample belongs to.