the global object carries every platform global its claimed Chromium major carries
Check id window-globals-vs-baseline
What an ordinary browser yields
Every platform global that the population of real builds of your claimed Chromium major carries is present here. Extra globals are normal and are not scored.
What a detector infers
The list of names on the global object is not written by the page — it is installed by the engine when it sets up a realm, from a table compiled into the binary. It therefore moves with the milestone: features ship, features are removed, and every real build of Chromium N ends up with the same platform globals. That makes it the one surface where a POPULATION answers a question no self-check can. The audit's other global-object row (window-globals-vs-realm) holds this build against a fresh realm of itself, which catches deletion and re-definition but cannot see a whole feature compiled out, because the iframe realm of a stripped build is stripped too. Held against what nine in ten captures of the claimed major actually carry, an absence becomes legible: a global that every genuine build of this version has, and this one does not. The asymmetry is what keeps it fair. Only ABSENCE is scored, never addition — a real page adds globals (this one adds its framework's), extensions and wallets add more, and no corpus can separate an honest addition from a tooling artifact. Nothing legitimate REMOVES a compiled-in global. Two guards keep the baseline honest: a name enters it only when 90% of that major's captures agree, so one unusual donor cannot write history, and a major with fewer than 25 captures is not published at all — the row then reports N/A rather than inventing a verdict from thin evidence.
How to resolve it
A global the population has and you do not is a feature compiled out of the binary, or a global deleted at runtime to hide a tool. Run the engine your user agent claims, and stop deleting globals — the deletion is more visible than what it hides.
Read in the wild by
Kasada
Spends 44 of its 427 probes enumerating the global object in both the main window and a fresh iframe — win_own_props_*, win_keys_* and the iframe_* twins — sampling length plus five indices and five slice indices from each, then diffing against a server-side model of stock Chrome.
win_own_props_length / win_own_props_0..4 / win_own_props_slice_* and the iframe_ prefixed pairs, decompiled ips.js
Kasada ips.js teardown (emro.cat)
FakeBrowser (collector)
Stores Object.getOwnPropertyNames(window) as its own field, `windowVersion`, filtered of numeric and underscored keys — a spoofer harvesting the global list precisely so it can be replayed later, which is only worth doing if somebody is checking it.
dumpWindowVersion(), script/dumpDD.js
kkoooqq/fakebrowser script/dumpDD.js
Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Automation surface
- window.chrome.* helpers are native (not JS stubs)
chrome-native-stubsWhere the previous check asks whether window.chrome exists, this one asks whether its members are genuine. - no notifications-permission headless bug
permissions-notification-bugTwo independent APIs describe the same underlying notification permission: navigator.permissions.query({name:'notifications'}) returns a… - permissions.query is native (arity throw + stack shape)
permissions-query-stackThis probe calls navigator.permissions.query() with exactly zero arguments and inspects the error the native arity check produces. - timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated… - the element prototype chain matches its claimed Chromium major's
element-surface-vs-baselineA for..in over the document element does not enumerate one object: it walks the whole prototype chain — HTMLElement, Element, Node… - document.hidden agrees with document.visibilityState
document-visibility-coherencedocument.hidden and document.visibilityState are two views of one piece of state, and the specification defines the first in terms of the… - navigator.plugins is a real IDL collection, not a JavaScript object
plugins-idl-index-wraparoundA real navigator.plugins is a PluginArray — a C++-backed IDL collection — and its indexed getter runs the Web IDL unsigned-long conversion… - navigator.storage quota is the same in the window and a same-origin worker
storage-quota-worker-vs-mainnavigator.storage.estimate().quota describes one storage partition, and a same-origin worker shares that partition — a single QuotaManager…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family window-globals-vs-baseline belongs to.