the global object lists its globals in the order genuine Chrome of the claimed major does
Every global this browser shares with genuine Chrome of its claimed major appears in genuine Chrome's order (up to three may move: deleting and redefining a single global moves it to the end). N/A without a reference for the claimed major, on mobile, and on non-Chromium engines (severity: warn).
What a detector infers
Object.getOwnPropertyNames(window) lists the globals in the order the realm installed them, and official Chrome does not install them one by one at runtime: it restores the global object from a V8 context snapshot built into the binary, which fixes the order when the browser is compiled. A build shipped without that snapshot installs the same interfaces through a different path, and the same names come out in a different order.
Measured on Chrome 153 (Windows 11): five genuine launch modes — headed and headless, the browser's own switches and an automation framework's — enumerate all 1233 globals in one identical order, and Edge 153 matches it name for name except for the two globals the two vendors differ on. A Chromium 153 build packaged without the context snapshot carries exactly the same 1233 names and moves 81 of them.
The comparison runs only over names both lists share, so globals an extension or the page itself ADDS are never compared — only the order of the platform's own. window-globals-vs-realm cannot see this: it compares the page against a fresh iframe of the same build, and both realms come out of the same install path.
How to resolve it
The order is decided when the browser is built. Ship Chrome's V8 context snapshot for the target platform — it has to be generated for that platform, so a cross-compiled build can silently go without it — or report the Chromium major the binary actually is.
Nearby checks in Automation surface
- permissions.query is native (arity throw + stack shape)
permissions-query-stackThis probe calls navigator.permissions.query() with exactly zero arguments and inspects the error the native arity check produces. - timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated… - the media-session counter runs forward and does not restart
eme-session-counter-monotonicA deployed commercial agent opens a ClearKey media session purely to read its identifier as a number — and then, if that number comes back… - the global object carries every platform global its claimed Chromium major carries
window-globals-vs-baselineThe list of names on the global object is not written by the page — it is installed by the engine when it sets up a realm, from a table… - the element prototype chain matches its claimed Chromium major's
element-surface-vs-baselineA for..in over the document element does not enumerate one object: it walks the whole prototype chain — HTMLElement, Element, Node… - document.hidden agrees with document.visibilityState
document-visibility-coherencedocument.hidden and document.visibilityState are two views of one piece of state, and the specification defines the first in terms of the… - navigator.plugins is a real IDL collection, not a JavaScript object
plugins-idl-index-wraparoundA real navigator.plugins is a PluginArray — a C++-backed IDL collection — and its indexed getter runs the Web IDL unsigned-long conversion… - navigator.storage quota is the same in the window and a same-origin worker
storage-quota-worker-vs-mainnavigator.storage.estimate().quota describes one storage partition, and a same-origin worker shares that partition — a single QuotaManager…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family window-globals-order-vs-baseline belongs to.