a worker resolves the same IANA timezone as the main thread
Check id worker-main-timezone-coherence
What an ordinary browser yields
Every worker resolves the same IANA timezone string as the main thread, because one host timezone feeds both globals.
What a detector infers
A browser has one host timezone, and the specification ties both the main-thread global and every worker global to it, so a real browser resolves the same IANA zone string on both — they come from a single ICU source shared across threads and are byte-identical. This holds on every engine: Chrome, Safari, Brave, Edge, mobile and WebView all inherit one per-process host zone into their workers, and Firefox with resistFingerprinting forces UTC uniformly across all threads. A split arises only one way: a spoofer overrides the zone on the main-thread document but the override never reaches the worker globals, so the worker falls back to the real system zone. That is precisely the geoip timezone path in a Firefox-based anti-detect browser, whose timezone manager reads storage the worker hook never sees, and it is a place the audit was blind — the worker checks compared user agent, platform and cores across realms but not the timezone, even though the reading was already being collected. The comparison is scored on the IANA string alone. The getTimezoneOffset minute value is deliberately not the trigger, because the same zone name already implies the same DST rules and the same offset, so an offset-only mismatch is either redundant with the string mismatch or a false positive from two Date reads straddling a daylight-saving transition instant — a one-second window twice a year. An empty or missing worker zone is treated as not-applicable rather than a failure, so the intermittent empty read one tracker report describes declines instead of firing.
How to resolve it
A timezone override has to reach the worker globals, not just the main-thread document. Set the zone at the browser layer, below JavaScript, so the single host timezone every thread reads from is already correct — patching only the page world leaves WorkerNavigator resolving the real system zone.
Read in the wild by
Camoufox issues
The Firefox anti-detect tracker records worker threads leaking the real system timezone while the main thread shows the proxied/geoip zone — the exact split this reads.
daijro/camoufox #541, #545, #657 (worker timezone leak)
daijro/camoufox#541Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Navigator identity
- browser-brand and context hints agree with a fresh realm
brand-hints-vs-realmSome of the cheapest signals to fake are the ones that say which browser this is: navigator.brave exists only in Brave, window.duckduckgo… - location.origin is the serialisation of its own protocol, host and port
location-origin-coherenceAn origin is not stored next to a URL, it is serialised from it: for an http or https document, origin is exactly the scheme, followed by… - navigator.vendor is the constant the measured engine compiles in
navigator-vendor-vs-enginenavigator.vendor is not a preference or a setting — it is a string constant compiled into the engine. - navigator.oscpu names the same OS family as the user-agent
ua-oscpu-os-family-coherencenavigator.oscpu is a property only Gecko still exposes — Chromium removed it and WebKit never had it — so this check is silent on every… - the keyboard layout maps the OEM keys the way one real Windows layout would
keyboard-layout-single-originA keyboard layout is not a set of independent key mappings — it is one artifact the operating system hands over whole. - navigator.appVersion is the user agent minus its leading token
appversion-vs-useragentnavigator.appVersion is not an independent fact. In Blink and WebKit it is computed from the User-Agent at read time — literally the UA with… - Trusted Types hands back the branded object its own type demands
trusted-types-value-invariantTrusted Types is a typed API, not a boolean feature flag, and that is the whole of the check. - the user agent on the wire and the one JavaScript reports describe the same browser
ua-wire-vs-navigatorYour user agent is asserted on two channels built by different layers: the network stack writes the header, and the renderer answers…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Navigator identity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Navigator identity — the family worker-main-timezone-coherence belongs to.