SharedArrayBuffer exposure agrees with the reported cross-origin isolation
If crossOriginIsolated reports true, SharedArrayBuffer is exposed. A constructor present without isolation is engine-dependent, reported but not asserted.
What a detector infers
Asking whether SharedArrayBuffer exists would measure the wrong machine: its exposure is gated by the COOP and COEP headers THIS site sends, so the answer describes our configuration rather than the visitor's browser — which is why the Blink-API presence check deliberately excludes it.
What is checkable without that problem is the relationship between two things the browser reports about itself. window.crossOriginIsolated is the browser's own statement about whether the document's agent cluster qualifies for isolation, and SharedArrayBuffer's availability is defined in terms of exactly that state. So the two have to agree no matter what headers this page happened to send, and the check works on any origin without knowing what we served.
Only the specified direction is asserted — isolation implies the constructor — because the converse is genuinely engine- and platform-dependent, and asserting it would convict ordinary browsers.
How to resolve it
crossOriginIsolated is derived from the real agent cluster. If it is being reported from an overridden value, every surface gated on it — SharedArrayBuffer, the high-resolution timer grid, memory measurement — keeps answering from the real state and contradicts it.
Nearby checks in Capability surfaces
- the permission descriptors this build accepts are the platform's, not a lookup table's
permission-name-support-setThe Permissions specification deliberately fixes no list of names. - form-factor-gated APIs match the form factor the client hints claim
platform-gated-apis-vs-form-factorSome Web APIs are not compiled for every platform, so their presence is a fact about the binary rather than about the user agent. - Web Bluetooth is present or absent as the claimed desktop platform requires
bluetooth-availability-vs-platformnavigator.bluetooth is part of Chrome's desktop surface on Windows, macOS and Linux, and it is provided by the platform layer rather than by… - the WebAuthn surface is as complete as the claimed platform's browser ships it
webauthn-surface-vs-platformWebAuthn reaches further down the stack than most web APIs: PublicKeyCredential is not a self-contained JavaScript object but the front door… - the deprecated and modern storage-quota APIs report the same origin quota
legacy-quota-surface-agreementnavigator.webkitTemporaryStorage.queryUsageAndQuota and navigator.storage.estimate() describe the same thing — this origin's storage quota… - the Storage Buckets API reports the same origin quota as navigator.storage
storage-buckets-quota-agreementThere are three ways to ask this origin how much storage it may use, and they all describe one number. navigator.storage.estimate() is the… - the origin private file system works if it is exposed
opfs-surface-vs-platformThe Origin Private File System is the newest of this origin's several storage doors, and a persona reaches it last if at all — the same… - navigator.cookieEnabled agrees with whether a cookie can actually be stored
cookie-enabled-vs-actual-writenavigator.cookieEnabled is a claim; writing a cookie and reading it back is a measurement.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Capability surfaces checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Capability surfaces — the family sharedarraybuffer-vs-isolation belongs to.