the WebAuthn surface is as complete as the claimed platform's browser ships it
On a secure context claiming desktop Chrome, PublicKeyCredential exists and exposes isUserVerifyingPlatformAuthenticatorAvailable — the shape every current Chrome ships.
What a detector infers
WebAuthn reaches further down the stack than most web APIs: PublicKeyCredential is not a self-contained JavaScript object but the front door to the platform's authenticator plumbing, which is why isUserVerifyingPlatformAuthenticatorAvailable exists at all — it asks the operating system a question. That gives the surface a shape that is hard to counterfeit and easy to check.
Every current Chrome on a secure context defines the constructor and that query; recent versions add getClientCapabilities alongside. The failure this catches is a build where the constructor survives but the plumbing behind it does not, producing a combination — the front door present, the thing it opens onto missing — that no shipping browser has.
It is scored against the claimed desktop OS and gated on a secure context, because WebAuthn is correctly absent on an insecure origin and that absence says nothing about the build. Warn rather than critical: the surface has been moving as the specification lands, and a row that reads a young API should not convict on a version difference.
How to resolve it
The authenticator layer is compiled into the browser and talks to the operating system, so it cannot be restored from page script. If a persona claims a desktop Chrome, run a build that has the layer rather than defining the constructor on window — the first capability call made against a stand-in gives it away immediately.
Read in the wild by
CloakBrowser issues
A stealth-browser tracker records the WebAuthn client-capability surface as one that goes missing on patched builds while the identity still claims a platform whose browser ships it.
CloakHQ/CloakBrowser #147, #176 (WebAuthn / client capabilities surface)
CloakHQ/CloakBrowser#147Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Capability surfaces
- the user-agent stylesheet resolves identically in a fresh realm
default-style-values-vs-realmEvery browser ships a user-agent stylesheet: the rules that make a heading bold and a button look like a button before any site CSS exists. - the permission descriptors this build accepts are the platform's, not a lookup table's
permission-name-support-setThe Permissions specification deliberately fixes no list of names. - form-factor-gated APIs match the form factor the client hints claim
platform-gated-apis-vs-form-factorSome Web APIs are not compiled for every platform, so their presence is a fact about the binary rather than about the user agent. - Web Bluetooth is present or absent as the claimed desktop platform requires
bluetooth-availability-vs-platformnavigator.bluetooth is part of Chrome's desktop surface on Windows, macOS and Linux, and it is provided by the platform layer rather than by… - the deprecated and modern storage-quota APIs report the same origin quota
legacy-quota-surface-agreementnavigator.webkitTemporaryStorage.queryUsageAndQuota and navigator.storage.estimate() describe the same thing — this origin's storage quota… - the Storage Buckets API reports the same origin quota as navigator.storage
storage-buckets-quota-agreementThere are three ways to ask this origin how much storage it may use, and they all describe one number. navigator.storage.estimate() is the… - the origin private file system works if it is exposed
opfs-surface-vs-platformThe Origin Private File System is the newest of this origin's several storage doors, and a persona reaches it last if at all — the same… - SharedArrayBuffer exposure agrees with the reported cross-origin isolation
sharedarraybuffer-vs-isolationAsking whether SharedArrayBuffer exists would measure the wrong machine: its exposure is gated by the COOP and COEP headers THIS site sends…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Capability surfaces checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Capability surfaces — the family webauthn-surface-vs-platform belongs to.