navigator.webdriver is a native prototype getter returning false
Check id webdriver-descriptor-integrity
What an ordinary browser yields
A native Navigator.prototype getter, no own property on the navigator instance, and the value false.
What a detector infers
Rather than reading the value, this check inspects the property's shape: it requires a getter on Navigator.prototype whose Function.prototype.toString output contains { [native code] }, no own shadowing descriptor on the navigator instance itself, and a value of exactly false. In a stock Chromium build all three hold, because webdriver is a spec-defined prototype accessor implemented in C++. The two common ways to make the value look clean each break a different invariant: deleting the prototype property (the undetected-chromedriver approach) leaves the read as undefined with no native getter, while defining a JS override installs an own descriptor whose getter stringifies to its own source instead of native code. So a detector can distinguish 'false because the engine says so' from 'false because something in JavaScript said so', and only the first is a shape a real browser produces. The check is skipped (N/A) when window.chrome is absent, since the invariant is Blink-specific.
How to resolve it
Govern the value in the engine so the native prototype getter itself returns false — clearcote does this. Remove any delete navigator.__proto__.webdriver or Object.defineProperty(navigator, 'webdriver', ...) shim; both are descriptor-shape tells even though the observed value looks correct.
Read in the wild by
PerimeterX / HUMAN
The collector hashes the webdriver property descriptor read off Navigator.prototype — the getter stringified, concatenated with the descriptor's value — then recomputes that same hash using a hidden iframe's copy of Object.getOwnPropertyDescriptor, so hooking getOwnPropertyDescriptor in the page's own realm does not change the answer. A separate probe asks whether navigator has an own webdriver property and whether writing to it sticks.
main.min.js (PerimeterX collector, iFood build) — main realm: `kD(t,hQ(757),(function(){var t=Object[hQ(698)](Object.getPrototypeOf(hU),BL);if(t)return kn(""+(t.get||"")+(t[hQ(396)]||""))}),"")` with hU=navigator, BL=jb("d2ViZHJpdmVy")='webdriver', hQ(698)='getOwnPropertyDescriptor', hQ(396)='value', hQ(757)=field 'IU0UR2QsEHE='. Cross-realm twin, EV2 field "BFAxGkI9Oi8=": `kD(t,"BFAxGkI9Oi8=",(function(){var t=n[BJ][hQ(209)](this,Object.getPrototypeOf(hU),BL);if(t)return kn(""+(t[hQ(279)]||"")+(t.value||""))}),"")`, where BJ=jb("T2JqZWN0LmdldE93blByb3BlcnR5RGVzY3JpcHRvcg==")='Object.getOwnPropertyDescriptor' and n=CH(BM,nG) resolves it off the hidden iframe (`nH=hT.createElement("iframe")`, `nH.style.display="none"`, `nG=nH.contentWindow`) — both read "90e65465" in the clean capture. Write/own-property probe → EV2 field 'O2sOIX4MCxs=' (true when clean): `function AT(){try{var t=jb("d2ViZHJpdmVy"),n=!1;return hU[t]||hU[hQ(145)](t)||(hU[t]=1,n=1!==hU[t],delete hU[t]),n}catch(t){return!0}}` with hQ(145)='hasOwnProperty'. Same probe pair present in the Walmart and Total Wine builds under different minified names.
CreepJS
CreepJS, an open-source research demo rather than a production detector, ORs three separate signals into one webDriverIsOn verdict: navigator.webdriver being truthy, navigator.webdriver reading undefined on any browser new enough to support border-end-end-radius (this clause is not engine-gated, unlike a sibling in the same object that tests IS_BLINK), and its lieProps entry for Navigator.webdriver — the lie detector pulls webdriver's getter off the prototype's property descriptor and runs it through the same [native code]/toString/own-property battery it applies to every other targeted API, so a getter that fails on shape counts the same as webdriver simply being on.
src/headless/index.ts: `webDriverIsOn: ((CSS.supports('border-end-end-radius: initial') && navigator.webdriver === undefined) || !!navigator.webdriver || !!lieProps['Navigator.webdriver'])` — compare the Blink-gated sibling in the same object: `noWebShare: IS_BLINK && CSS.supports('accent-color: initial') && (…)`. src/lies/index.ts: `searchLies(() => Navigator, { target: [… 'vendorSub', 'webdriver', 'gpu' ] })`; the accessor is reached via `const getterFunction = Object.getOwnPropertyDescriptor(proto, name).get!` then `queryLies({ scope, apiFunction: getterFunction, proto, obj, lieProps: props })`, whose tests include `!hasKnownToString(name)[scope.Function.prototype.toString.call(apiFunction)]`; lie keys are built as `${obj.name}.${name}` → the `'Navigator.webdriver'` key indexed above.
Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- navigator.webdriver does not assert WebDriver control
webdriver-offThis check is intentionally one-way. The WebDriver specification defines navigator.webdriver as the browser's assertion that it is under… - no Selenium / Puppeteer / Playwright globals
automation-globalsThis check tests a fixed list of roughly two dozen known names against both window and document (Selenium's __webdriver_evaluate /… - DevTools Runtime serialization is not active
runtime-enable-leakAn attached DevTools Runtime domain serialises console arguments and reads an Error stack accessor. - No Puppeteer / Playwright sourceURL marker
sourceurl-leakPuppeteer and Playwright evaluation labels can appear in main-world Error stacks. - No controller code crossed the main-world canary
main-world-executionAn early DOM canary records main-world calls, but page code and extensions can also call it, so this is contextual. - No exposed Puppeteer / Playwright binding
exposed-binding-leaksExposed functions leave Playwright/Puppeteer registries, prefixes, source text, or __installed markers. - Content Security Policy is enforced
csp-bypassThe audit excludes data: scripts. Execution despite script-src is direct CSP-bypass behavior. - window.chrome present for a Chrome UA
chrome-objectThis is a cross-check, not a probe of window.chrome's contents: it first decides whether the browser claims to be Chrome (a Chrome/ token in…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family webdriver-descriptor-integrity belongs to.