navigator.storage quota is the same in the window and a same-origin worker
Check id storage-quota-worker-vs-main
What an ordinary browser yields
The quota reported in the window and inside a same-origin worker agree to within 5% — they read one partition through one QuotaManager.
What a detector infers
navigator.storage.estimate().quota describes one storage partition, and a same-origin worker shares that partition — a single QuotaManager in the browser process answers both, keyed by one storage key. So the window and the worker must quote the same quota. This is the cleanest recorded instance of the main-world-only spoof failing: a page patched all three quota APIs from the main thread, and a detector simply read the quota inside a Worker, which a page-world override never reaches. The maintainer of the tracker said it in as many words — reading quota from a Web Worker bypasses page-script patches entirely — and the eventual fix was a binary-level flag, because a main-world-only override is incoherent by construction. The check compares quota only, never usage and never magnitude: no threshold, no ratio, nothing that could rot or unfairly flag a small disk or an incognito window. A 5% relative tolerance absorbs the few-megabyte drift a free-space-derived quota can show between two reads and is still far tighter than the documented spoof gap. It goes quiet rather than failing whenever StorageManager is absent on either side, the worker is blocked by a strict CSP without blob: in worker-src, or it times out.
How to resolve it
Quota is answered by one manager in the browser process, keyed by the storage partition, so it cannot differ between the window and a same-origin worker. A main-world override of navigator.storage.estimate does not reach a worker own navigator. Change it below JavaScript, or leave it native.
Read in the wild by
CloakBrowser issues
The canonical recorded case: a page patched all three quota APIs from the main world and a detector read the real value from a Worker the patch never reached.
CloakHQ/CloakBrowser #46, #44 (quota readable from Web Workers, bypassing page patches)
CloakHQ/CloakBrowser#46Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- permissions.query is native (arity throw + stack shape)
permissions-query-stackThis probe calls navigator.permissions.query() with exactly zero arguments and inspects the error the native arity check produces. - timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated… - document.hidden agrees with document.visibilityState
document-visibility-coherencedocument.hidden and document.visibilityState are two views of one piece of state, and the specification defines the first in terms of the… - navigator.plugins is a real IDL collection, not a JavaScript object
plugins-idl-index-wraparoundA real navigator.plugins is a PluginArray — a C++-backed IDL collection — and its indexed getter runs the Web IDL unsigned-long conversion… - performance.timeOrigin + performance.now() reconstructs Date.now()
clock-origin-coherenceA page has two clocks. performance.timeOrigin is the wall-clock moment its timeline began; performance.now() is the monotonic time elapsed… - the gesture that started this audit registered as a real user activation
user-activation-vs-interactionThis audit only runs when you press the Run button, and pressing a button is exactly what grants user activation — by pointer, by Enter or… - user activation only ever appeared after a real input event
activation-without-inputThe row above this one reads navigator.userActivation once and expects it to be true, because the audit is reached by pressing a button. - the clicks this page received were real clicks
interaction-click-trustEvent.isTrusted is set by the engine when it dispatches an event it generated itself, and it cannot be set from script - a constructed…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family storage-quota-worker-vs-main belongs to.