Check guide · In the browser

Browser data

The browser's own description of itself, checked for tool marks.

What this check is

Once the page runs, the browser describes itself through the navigator and screen objects: is it automated, what plugins it carries, how many threads, what screen, what it claims for touch. This check reads that self-description and looks for the specific ways it gives automation away, including the seams left by tools that patch these values to hide.

What Tells reads

navigator.webdriver, the single most direct automation flag a browser exposes
The client User-Agent for headless markers
The plugin list and its internal structure (empty or inconsistent lists are characteristic of headless and patched browsers)
Whether navigator property getters are still the browser's native code
Screen and viewport geometry, touch support against the claimed device class, notification permission state

How to read your result

Fail: navigator.webdriver is true, or the client User-Agent carries a headless marker.
Warning: Zero plugins in a Chromium browser, plugin entries that contradict each other, a getter that is not native code, impossible screen geometry, a mobile claim with no touch surface, or a notification permission state real browsers do not produce.
Pass: The self-description is ordinary and internally consistent.

Why it matters

Websites ask the browser who it is because the answers are free. The interesting half of this check is the patch detection: hiding webdriver is the first thing stealth tooling does, and doing it leaves its own evidence (a getter that is no longer native, a property redefined in the wrong place). A clean result here means the browser is either genuinely unmodified or modified very carefully.

Where this matters most

Across the platforms Blowhorn works with, rated in the platform guide (H = matters a lot, M = contributes, L = no public evidence; tags mark vendor-stated, reported, or inferred evidence):

LinkedIn (H): 48 hardware and software characteristics are collected per session [Reported]
X (M): device and browser properties plausibly feed risk signals [Inference]
Reddit (M): headless-style browser profiles correlate with network blocks [Reported]

Everywhere else in the set this one rates Low.

In your report

Find it in the checks table on the tool page, with the detail in the Browser section. The same findings appear in the report JSON under verdict.reasons, and the agent guide explains how to read them programmatically.