window.external is shaped the way the engine generates it
On Blink: an object with no own properties, both search-provider methods on its prototype, each stringifying as the engine's native form.
What a detector infers
A deployed commercial agent lists the absence of this object among its own named failure messages, which means it treats window.external missing as a value worth recording rather than an error worth ignoring. That is a reasonable thing to watch: the object is a vestige, two search-provider methods surviving from a browser era that has ended, and exactly the sort of surface a build assembles carelessly or drops altogether.
But the assertion worth making is not that the object exists. It is where its methods live. On a real Blink build the object has no own properties whatsoever — the two methods sit on its prototype, because that is how the binding layer generates every interface it produces, without exception.
A replacement written to satisfy a presence test assigns them directly onto the object instead, since that is the obvious way to write one and since nothing in a presence test can tell the two apart. Measured on a current Chromium: zero own property names, both methods on the prototype, both stringifying in the engine's native form.
So the structural question separates a generated interface from a hand-made one at no extra cost to whoever is asking, which is what makes it worth asking. The row is gated on the MEASURED engine rather than on the user agent, because Gecko and WebKit either omit this object or shape it differently, and their doing so is a fact about those engines rather than a defect — so it declines there instead of inventing a cross-engine expectation.
How to resolve it
If this object is being supplied rather than inherited from the engine, build it the way the binding layer does — an empty instance whose prototype carries native methods. Assigning them as own properties satisfies a presence test and fails a structural one.
Nearby checks in Automation surface
- the browser will not resolve a filesystem path the page invented
synthesized-path-entry-sandboxThis row does not measure a fingerprint. It measures whether the browser will help a page enumerate what is installed on the machine, and it… - no stylesheet is injecting custom properties into every page
injected-root-custom-propertiesA deployed commercial agent reads six CSS custom properties from the document's root element and reports true when four or more of them… - window.chrome present for a Chrome UA
chrome-objectThis is a cross-check, not a probe of window.chrome's contents: it first decides whether the browser claims to be Chrome (a Chrome/ token in… - window.chrome.* helpers are native (not JS stubs)
chrome-native-stubsWhere the previous check asks whether window.chrome exists, this one asks whether its members are genuine. - no notifications-permission headless bug
permissions-notification-bugTwo independent APIs describe the same underlying notification permission: navigator.permissions.query({name:'notifications'}) returns a… - permissions.query is native (arity throw + stack shape)
permissions-query-stackThis probe calls navigator.permissions.query() with exactly zero arguments and inspects the error the native arity check produces. - timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated… - the media-session counter runs forward and does not restart
eme-session-counter-monotonicA deployed commercial agent opens a ClearKey media session purely to read its identifier as a number — and then, if that number comes back…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family window-external-shape belongs to.
