Math.random / crypto.getRandomValues native and high-entropy
Check id rng-integrity
What an ordinary browser yields
Math.random is native (name "random", length 0, native source in both realms) with full-entropy output; crypto.getRandomValues is native and produces varied bytes.
What a detector infers
The check verifies that Math.random is the engine's native generator and that its output is high-entropy. It confirms the function's name is "random", its length is 0, and it stringifies as native code both in this realm and through a fresh iframe's toString; then it draws 2048 samples and asserts they all fall in [0,1), that at least 90% are distinct, and that their mean sits in a loose band around 0.5. It applies the same native check to crypto.getRandomValues and confirms 256 generated bytes are varied. The motivation is that some anti-detect kits reseed or wrap Math.random to make a run reproducible — for deterministic canvas or WebGL noise, or repeatable timing — and that replacement is what the probe detects. The primary signal is deliberately the native and cross-realm toString rather than the statistics: a well-built PRNG can pass distribution sanity, so the tampering shows up first as a non-native source or a wrapper the iframe's clean toString unmasks. The statistical bands are intentionally loose so a genuine engine PRNG is never convicted. Kasada samples both Math.random (its floor·4096, uint16 and sum probes) and crypto.getRandomValues.
How to resolve it
Do not reseed or wrap Math.random for reproducible runs. The wrapper is visible through its source and the cross-realm toString, and a seeded generator collapses output entropy. If determinism is needed for testing, seed a separate PRNG rather than overwriting the global.
Read in the wild by
Kasada
Samples both random sources — a patched Math.random and a crypto source delegating to it are both visible.
math_random_floor_4096, math_random_uint16, math_random_sum, math_random_pow, crypto_random_avg, crypto_random_raw, crypto_random_pow
Kasada ips.js teardown — the full 427-probe listEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Native function integrity
- Worker navigator matches the main thread
worker-navigator-coherenceA Blob-URL Worker is spawned and reports its own navigator.platform, navigator.hardwareConcurrency, navigator.webdriver and… - page-world natives that extensions commonly wrap
page-world-wrappersThis probe stringifies window.fetch and window.Request and asks whether each still renders as native code, then checks whether document… - nonexistent navigator properties return undefined
navigator-proxy-honeypotThis reads five navigator property names that exist on no browser — rml, ln, rnd, webdriverPatched and __clearcoteProbe — and additionally… - native methods enforce their C++ receiver check
native-brand-checksTwo native methods are invoked with their own bare prototype as the receiver… - iframe srcdoc/src/contentWindow live on the prototype
iframe-srcdoc-placementA fresh <iframe> is created with document.createElement and inspected for own property descriptors on srcdoc, src and contentWindow. - Element.attachShadow untampered (shape + closed/open behaviour)
shadow-dom-integrityThe check reads Element.prototype.attachShadow four ways and asserts they agree: its name is "attachShadow", its length (declared parameter… - the global object still has every global a fresh realm has, in the same order
window-globals-vs-realmThe audit builds a fresh same-origin iframe and enumerates the own properties of both global objects, then asserts two things a browser… - iframe.contentWindow really is a separate realm, and the one the browser says it is
contentwindow-realm-identityThis is the check that guards the others. A large part of this audit — the global property diff, all six capability surfaces, the brand…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Native function integrity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Native function integrity — the family rng-integrity belongs to.