the browser will not resolve a filesystem path the page invented
No filesystem entry is returned for a file the page constructed itself, whatever its name claims to point at.
What a detector infers
This row does not measure a fingerprint. It measures whether the browser will help a page enumerate what is installed on the machine, and it comes from the most invasive technique in a deployed commercial agent's collector set. The method: construct a file object whose NAME is an absolute path, place it in a drag-and-drop data transfer, ask that item for a filesystem entry, and call getParent on whatever comes back. If the parent resolves, the directory exists on the host.
The agent runs that against sixty-two paths of a single shape — a per-application media directory, one per application identifier — covering messaging, social, dating, ride-hailing, banking and fintech software, and at least one national government identity application. A directory that exists means the application is installed. That is installed-software enumeration from a web page, and the list is selected to reveal things about a person rather than about a browser.
The invariant needs no reference data at all, which is what makes it safe to score strictly: an entry returned here would describe a path THE PAGE INVENTED, not anything a person chose to hand over. The drag-and-drop bridge exists to describe items someone actually dropped, so for a synthesised item the correct answer is nothing.
Measured on a current desktop Chromium, the entry accessor returns null for a programmatically added file, which is right — and is why the technique is aimed at platforms that behave differently.
How to resolve it
Nothing to configure; current desktop builds already answer correctly. A build that returns an entry has made the drag-and-drop bridge reachable without a drag, at which point it can be walked to test whether any path exists on the host — a disclosure about the person using the machine rather than about the browser.
Nearby checks in Automation surface
- No Puppeteer / Playwright sourceURL marker
sourceurl-leakPuppeteer and Playwright evaluation labels can appear in main-world Error stacks. - No controller code crossed the main-world canary
main-world-executionAn early DOM canary records main-world calls, but page code and extensions can also call it, so this is contextual. - No exposed Puppeteer / Playwright binding
exposed-binding-leaksExposed functions leave Playwright/Puppeteer registries, prefixes, source text, or __installed markers. - Content Security Policy is enforced
csp-bypassThe audit excludes data: scripts. Execution despite script-src is direct CSP-bypass behavior. - no stylesheet is injecting custom properties into every page
injected-root-custom-propertiesA deployed commercial agent reads six CSS custom properties from the document's root element and reports true when four or more of them… - window.chrome present for a Chrome UA
chrome-objectThis is a cross-check, not a probe of window.chrome's contents: it first decides whether the browser claims to be Chrome (a Chrome/ token in… - window.chrome.* helpers are native (not JS stubs)
chrome-native-stubsWhere the previous check asks whether window.chrome exists, this one asks whether its members are genuine. - window.external is shaped the way the engine generates it
window-external-shapeA deployed commercial agent lists the absence of this object among its own named failure messages, which means it treats window.external…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family synthesized-path-entry-sandbox belongs to.