no non-standard shadow-root escape hatch exists on Element.prototype
Check id shadow-escape-hatch-absent
What an ordinary browser yields
None of the known escape-hatch properties exists on Element.prototype. A stock browser answers false to every one of them.
What a detector infers
Closed shadow roots exist to be unreachable: element.shadowRoot returns null for them, and that is the whole contract. Automation frequently needs to reach inside one anyway — to click a control a site built as a closed component — and the cheapest way to get there is to patch the engine and add a property that hands the root over. That property then exists on Element.prototype for every page the build ever loads. It is the single cheapest tell in this entire audit: a detector does not have to measure a value, compare two realms, or know anything about the host. It reads one name off a prototype, and no shipping browser has that name. The asymmetry is what makes it worth its own row — a build can get canvas, WebGL, fonts and timing all perfectly coherent and still be identified in one `in` test because a debugging affordance was left switched on in production. The names probed here are the ones patched builds actually use, and the check is deliberately limited to Blink: Gecko exposes openOrClosedShadowRoot to extension content scripts as a documented API, so asserting it everywhere would convict Firefox for a feature it is supposed to have.
How to resolve it
Put the escape hatch behind a runtime-enabled feature that stays off unless an automation session explicitly asks for it, so ordinary page script never sees the property. An always-on named property is a permanent, zero-effort identifier for every user of that build — and unlike a fingerprint value it cannot be blamed on the host, because only the build could have added it.
Read in the wild by
CloakBrowser issues
A stealth-browser tracker documents exactly this affordance — a native property added to reach closed shadow roots — and the discussion of gating it behind a launch flag rather than exposing it unconditionally.
CloakHQ/CloakBrowser #137 (closed shadow root access / FakeShadowRoot)
CloakHQ/CloakBrowser#137Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- dragging the slider moved it through the values it crossed
slider-drag-value-progressionA range slider is the only common control that has to be DRAGGED to be used as intended, which makes it the only one that produces a stream… - clicks landed on different points, not the same one repeatedly
pointer-landing-dispersionAiming is imprecise. A hand lands somewhere inside a control and the spread shows up within two or three clicks; a driver resolves the… - the button stayed pressed for the whole hold
hold-button-state-coherentThe gate's press-and-hold step asks for a button to be held for over a second, which is two orders of magnitude longer than a click's dwell… - the pointer travelled to each control it pressed
pointer-approach-per-targetThe gate asks for four separate acts in four separate places - three markers, a text field, a slider and a dropdown - and a pointer has to… - the pointer accelerated and slowed on its way to each control
pointer-approach-speed-profileA pointer moved by an arm leaves rest, accelerates, and brakes into its target, so the distance covered between consecutive samples rises… - no automation pointer-flash artifact is present
pointer-flash-keyframe-artifactThe only row on this page that works by recognising a specific string, which needs justifying because a name table is exactly what this… - pageXOffset/pageYOffset match their scrollX/scrollY aliases
scroll-alias-coherencewindow.pageXOffset is not a second scroll position, it is a legacy alias of window.scrollX — the specification defines them as the same… - a focused child frame implies its parent document is focused
document-focus-vs-realmdocument.hasFocus() is true when the document OR any of its descendants holds focus, which makes it hierarchical rather than local: a…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family shadow-escape-hatch-absent belongs to.