the storage quota is reported against the JS heap ceiling it gets compared to
Check id storage-quota-vs-heap-ceiling
What an ordinary browser yields
Contextual only. The ratio is shown, with both published readings named, because they disagree by construction and this page does not pick a side.
What a detector infers
Two published classifiers read the ratio between an origin's storage quota and the JavaScript heap ceiling, and — this is the whole point of the row — they read it in opposite directions. One treats a quota below roughly twice the heap limit as evidence of a private window. The other treats a quota close to the heap limit as evidence of a driven browser. Both are deployed, and no single quota satisfies both: tuning the number to pass one classifier moves it toward failing the other. That is worth showing precisely because it is the kind of trap that looks like a bug and is actually a design constraint. A build that discovers one of these tests, adjusts its quota, and ships is not finished — it has traded one classifier for another, and it will find out from a different vendor. This audit does not adopt anyone's threshold as a verdict, so the row REPORTS the ratio and names both readings rather than scoring either. The honest resolution is not a tuned constant at all: it is a quota derived from the real disk, which lands where an ordinary machine's lands and therefore satisfies the only test that generalises.
How to resolve it
Derive the quota from the real available disk rather than pinning it to a constant chosen to defeat a specific classifier. A tuned value passes the test it was tuned for and fails the next one; a real value passes both for the same reason an ordinary machine does. If it must be normalised, normalise it below the API layer so every surface reporting it agrees.
Read in the wild by
CloakBrowser issues
A stealth-browser tracker works through this exact tradeoff at length: one detector wants a high quota relative to the heap and another wants a low one, with the vendor conceding no single value satisfies both.
CloakHQ/CloakBrowser #320, #377, #46, #44 (storage quota vs heap ratio classifiers)
CloakHQ/CloakBrowser#320Clearcote (measured)
The reason this row reports instead of scoring, measured rather than reasoned: an ordinary desktop browser in a perfectly ordinary window already lands BELOW the ratio one published classifier reads as a private window. Scoring that threshold would have accused an honest visitor on the first run.
stock desktop Chromium on Windows: quota 3,343,962,173 bytes against a 4,294,967,296-byte heap ceiling — a ratio of 0.78, under the ~2.0 one classifier treats as private
Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Environment & locale
- the voice list arrives the way Chrome delivers it
speech-voices-async-pathspeech-voices reads WHAT is in the voice list. This reads HOW the list arrived, which is a separate fact and survives a roster whose every… - an OS that ships a speech synthesiser enumerates at least one voice
speech-voices-vs-platformThe plain speech-voices readout above refuses to score an empty list, and as written it is right to: Chrome does not build the voice list in… - a live audio destination corresponds to an audio device that exists
audio-sink-vs-device-listA resource oracle, and deliberately a different resource from the voice list. - WebSQL (openDatabase) is absent for Chrome ≥ 119
opendatabase-removedWebSQL was removed from Chrome in version 119, so window.openDatabase should not exist on any newer Chromium. - BatteryManager fields satisfy the spec's mutual-exclusion invariants
battery-spec-invariantsThe probe calls navigator.getBattery() once and records four fields together: level, charging, chargingTime, dischargingTime. - enumerateDevices exposes audiooutput on a Chromium claim
media-kinds-vs-engineThe probe calls navigator.mediaDevices.enumerateDevices() and keeps only each entry's .kind, sorted — never labels or deviceIds, which is… - mediaCapabilities and canPlayType agree about the same codec
mediacapabilities-vs-canplaytypeTwo different APIs answer from the same platform decoder registry. - the intrinsic size of an undecodable image is reported
broken-image-intrinsic-sizeAn image that cannot decode still has intrinsic dimensions, and where they come from is the interesting part: the browser substitutes a…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Environment & locale checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Environment & locale — the family storage-quota-vs-heap-ceiling belongs to.