pageXOffset/pageYOffset match their scrollX/scrollY aliases
pageXOffset equals scrollX and pageYOffset equals scrollY, exactly, because each pair is one value with two names.
What a detector infers
window.pageXOffset is not a second scroll position, it is a legacy alias of window.scrollX — the specification defines them as the same value and Blink backs both names with one getter. The same holds for pageYOffset and scrollY. Two names, one number, so they are incapable of disagreeing in a real browser. That makes this a complete test of whether both names still reach the same place, and it costs two property reads.
The shape it catches is a familiar one: a value rewritten through the name a script is expected to read, while the alias nobody remembered keeps reporting the truth. It is the same class of mistake as patching navigator.language and forgetting navigator.languages[0]. Worth noting that Kasada reads pageXOffset and pageYOffset and never scrollX or scrollY — reading only one name of an aliased pair is what makes the pair assertable by someone who reads both.
How to resolve it
Do not patch one name of an aliased pair. If a scroll position must differ, scroll the document — the alias is not a second source that can be updated to match, it is the same source, and the disagreement itself is the tell.
Read in the wild by
Kasada
Reads pageXOffset/pageYOffset and never scrollX/scrollY — reading only one name of an aliased pair is what leaves the pair assertable by someone who reads both.
window_page_x_offset, window_page_y_offset
Kasada ips.js teardown — the full 427-probe listEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- clicks landed on different points, not the same one repeatedly
pointer-landing-dispersionAiming is imprecise. A hand lands somewhere inside a control and the spread shows up within two or three clicks; a driver resolves the… - the button stayed pressed for the whole hold
hold-button-state-coherentThe gate's press-and-hold step asks for a button to be held for over a second, which is two orders of magnitude longer than a click's dwell… - the pointer travelled to each control it pressed
pointer-approach-per-targetThe gate asks for four separate acts in four separate places - three markers, a text field, a slider and a dropdown - and a pointer has to… - the pointer accelerated and slowed on its way to each control
pointer-approach-speed-profileA pointer moved by an arm leaves rest, accelerates, and brakes into its target, so the distance covered between consecutive samples rises… - no automation pointer-flash artifact is present
pointer-flash-keyframe-artifactThe only row on this page that works by recognising a specific string, which needs justifying because a name table is exactly what this… - a focused child frame implies its parent document is focused
document-focus-vs-realmdocument.hasFocus() is true when the document OR any of its descendants holds focus, which makes it hierarchical rather than local: a… - no non-standard shadow-root escape hatch exists on Element.prototype
shadow-escape-hatch-absentClosed shadow roots exist to be unreachable: element.shadowRoot returns null for them, and that is the whole contract. - the markup this page was served with is the markup that reached the DOM
served-markup-integrityEvery other check on this page asks the browser about itself.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family scroll-alias-coherence belongs to.