A fresh frame has none of Node's, Deno's, Bun's or Pyodide's globals
typeof each listed name is 'undefined' in a fresh same-origin frame. N/A when no frame can be created (severity: warn).
What a detector infers
A new about:blank frame starts with the browser's own globals and nothing else, because no page script has run in it. process, module, require, global, Buffer, exports and __dirname belong to Node; Deno and Bun name themselves; pyimport is Pyodide's bridge. When one of them is visible in a fresh frame, the 'browser' is an emulated DOM such as jsdom or happy-dom, or a runtime whose own global leaks into every realm it creates.
Reading a fresh frame instead of the page keeps the row honest: the audit page itself, or a bundler polyfill on it, cannot put these names into a frame it never wrote to. A widely deployed CAPTCHA's challenge script tests typeof module, global, process and pyimport the same way. Measured on 2026-10-28: every name undefined in Google Chrome 154–156, Chromium 153 and Clearcote r52 on Linux.
How to resolve it
Use a real browser. A DOM emulated inside Node or another runtime cannot hide that runtime's globals from every new realm it builds.
Nearby checks in Automation surface
- The user agent names no headless product
headless-ua-tokenBoth of Chrome's headless modes name themselves in the user agent. - history.replaceState to another origin throws SecurityError
history-replacestate-cross-origin-throwshistory.replaceState may change the URL shown for a document only within its own origin; the HTML standard requires a SecurityError for any… - No automation extension has written its marker into the page
automation-extension-markupSome automation tools announce themselves in the pages they control. - No interface stable Chrome keeps behind a developer switch is exposed
flag-only-surfaces-absentStable Chrome keeps unfinished web platform features behind developer switches, and some of them add global interfaces as soon as the switch… - No debugger client attached to this tab after it loaded
console-replay-trapV8 keeps the console messages a page logs, which is why DevTools can show messages logged before it was opened. - navigator.webdriver does not assert WebDriver control
webdriver-offThis check is intentionally one-way. The WebDriver specification defines navigator.webdriver as the browser's assertion that it is under… - navigator.webdriver is a native prototype getter returning false
webdriver-descriptor-integrityRather than reading the value, this check inspects the property's shape: it requires a getter on Navigator.prototype whose… - No Selenium / Puppeteer / Playwright globals
automation-globalsThis check tests a fixed list of roughly two dozen known names against both window and document (Selenium's __webdriver_evaluate /…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family runtime-globals-absent-in-fresh-frame belongs to.