Browser Security Diagnostics

Browser:

Detecting…

Operating System:

Architecture:

What This Page Tests

Each test probes a browser security or privacy control. Results indicate how the browser is configured — PASS means locked down, WARN means partially restricted or informational, FAIL means the control is absent or accessible.

PASS — locked down WARN — partial / note FAIL — exposed INFO — data only

Push Notifications

Notification Permission State —
Checks whether this site has been granted, denied, or not yet asked for notification permission.
Send Test Notification —
Requests permission if needed, then fires a real browser notification. Verifies the full push pipeline works (or is blocked).
Service Worker / Push API —
Checks if the Service Worker and Push Manager APIs are available — required for background push notifications even when the page is closed.

Permissions & APIs

Geolocation —
Queries the permission state for location access. A locked-down browser should prompt or deny.
Camera —
Queries the permission state for camera access.
Microphone —
Queries the permission state for microphone access.
Clipboard Read —
Checks whether the browser allows pages to read clipboard contents. A locked-down browser should deny or prompt.
Clipboard Write —
Attempts to write a test string to the clipboard. Most browsers allow this with user gesture; some restrict it.
Persistent Storage —
Requests persistent storage (prevents browser from evicting site data). Checks if the browser grants it silently without user prompt.

Isolation & Privacy

window.opener Leakage —
Opens a blank tab via JS and checks if that tab's opener references this window. Modern browsers (Chrome 88+, Firefox 79+) auto-add noopener to new tabs.
Referrer Policy —
Checks the page's referrer policy. strict-origin-when-cross-origin or stricter is preferred; weak policies leak full URLs to third parties.
navigator.sendBeacon —
Checks if sendBeacon is available. This API sends data on page unload without user awareness and can bypass some tracking blockers.
Third-Party Cookie State —
Uses the Storage Access API to check whether third-party storage access is available. Locked-down browsers block third-party cookies and storage by default.

Fingerprinting Surface

Canvas Fingerprinting —
Draws text to a hidden canvas and reads pixel data. If the browser blocks or randomizes canvas reads, fingerprinting is prevented.
WebGL Renderer Info —
Attempts to read GPU vendor and renderer strings via the WEBGL_debug_renderer_info extension. Exposed GPU info is a strong fingerprinting signal.
Hardware Concurrency & Memory —
Reads navigator.hardwareConcurrency (CPU core count) and navigator.deviceMemory (RAM in GB). Locked browsers mask or omit these values.
User-Agent String —
Reads the full User-Agent string and Client Hints. Privacy browsers may return a generic or reduced UA.

Network & Headers

Mixed Content Blocking —
On HTTPS pages, attempts to fetch an HTTP resource. A secure browser should block this. (Only meaningful over HTTPS.)
HTTPS / Protocol —
Checks whether the current page is loaded over HTTPS. HTTP connections are unencrypted and vulnerable to interception.
DNS Prefetch —
Checks if the browser supports DNS prefetching (rel=dns-prefetch). When uncontrolled, prefetch can leak visited domains to DNS resolvers.

Script & Content Controls

eval() Available —
Checks if eval() is callable. A Content Security Policy with unsafe-eval absent blocks it. eval() is often exploited in XSS attacks.
WebAssembly Available —
Checks if WebAssembly is available. WASM can be used to execute native-speed code in the browser, sometimes used in cryptojacking or obfuscated attacks.
Content Security Policy —
Checks for CSP enforcement by attempting an inline script injection and detecting the securitypolicyviolation event.

Storage Behavior

localStorage —
Attempts to write and read a test value in localStorage. Persistent across sessions; some privacy modes block or sandbox it.
sessionStorage —
Attempts to write and read a test value in sessionStorage. Clears on tab close; still potentially exploitable for session fixation.
IndexedDB —
Checks if IndexedDB is available and writable. A large client-side database that persists across sessions and can be exploited for tracking.
Cookie Attributes —
Sets a test cookie without Secure, HttpOnly, or SameSite flags. Checks if the browser allows it and reads back the cookie value.

Browser Settings Index

Quick links to this browser's configuration pages for each feature tested above. Internal browser URLs (chrome://, edge://, about:) will be copied to your clipboard — paste them in the address bar.

Detecting browser…