JavaScript Navigator taintEnabled() Method

What You’ll Learn

navigator.taintEnabled() is a legacy stub from JavaScript 1.2 data tainting. When the method exists it always returns false. Learn its history, limited browser support, five examples, and why modern security uses other tools.

Introduction

In very early JavaScript (around 1.2), some engines experimented with data tainting — a security idea that marked values from untrusted sources so scripts could not misuse them casually.

That model was removed long ago. Per MDN, navigator.taintEnabled() remains only so extremely old scripts do not break, and it always returns false when present.

Understanding the taintEnabled() Method

• No parameters — call navigator.taintEnabled().
• Return type — boolean false when the method exists.
• Feature-detect first — many Chromium / Safari builds omit it.
• HTML / Gecko note — the HTML Standard keeps it mainly for Gecko compatibility mode.
• Not a modern security API — use CSP, Permissions Policy, CORS, and related tools instead.

📝 Syntax

General form of the method:

navigator.taintEnabled()

Parameters

• None.

Return value

• Always the boolean false when the method is implemented.

Safe call pattern

const value =
  typeof navigator.taintEnabled === "function"
    ? navigator.taintEnabled()
    : null; // missing in this browser

console.log(value); // false or null

Examples Gallery

Examples show how to detect the method, confirm the always-false contract, and avoid treating it as a live security switch. Output may say missing on Chromium / Safari.

const lines = [
  "taintEnabled: " +
    (typeof navigator.taintEnabled === "function" ? "available" : "missing"),
  "javaEnabled: " +
    (typeof navigator.javaEnabled === "function" ? "available" : "missing")
];
console.log(lines.join("\n"));

taintEnabled: available
javaEnabled: available
(or taintEnabled: missing on Chrome / Safari)

if (typeof navigator.taintEnabled !== "function") {
  console.log("missing");
} else {
  const result = navigator.taintEnabled();
  console.log(String(result));
  console.log("typeof: " + typeof result);
  console.log("strict false: " + (result === false));
}

false
typeof: boolean
strict false: true
(or missing)

let mode = "modern-security";
if (
  typeof navigator.taintEnabled === "function" &&
  navigator.taintEnabled()
) {
  mode = "js12-tainting"; // never assigned when method returns false
}
console.log(mode);

modern-security

const summary = {
  taintEnabled:
    typeof navigator.taintEnabled === "function"
      ? navigator.taintEnabled()
      : null,
  javaEnabled:
    typeof navigator.javaEnabled === "function"
      ? navigator.javaEnabled()
      : null
};
console.log(JSON.stringify(summary));

{"taintEnabled":false,"javaEnabled":false}
(or {"taintEnabled":null,"javaEnabled":false})

function securitySnapshot() {
  return {
    taintEnabled:
      typeof navigator.taintEnabled === "function"
        ? navigator.taintEnabled()
        : "missing",
    isSecureContext: window.isSecureContext,
    cookieEnabled: navigator.cookieEnabled,
    tip: "Use CSP / Permissions / CORS — not taintEnabled()"
  };
}

console.log(JSON.stringify(securitySnapshot()));

{"taintEnabled":false,"isSecureContext":true,"cookieEnabled":true,"tip":"Use CSP / Permissions / CORS — not taintEnabled()"}
(taintEnabled may be "missing")

🚀 Common Use Cases

• Learning / interviews — explain JS 1.2 tainting and why the stub returns false.
• Reading ancient scripts — recognize dead if (taintEnabled()) branches.
• Engine quirks — understand Gecko compatibility vs Chromium omission.
• Teaching feature detection — contrast missing APIs vs always-false stubs.
• Not for product security — never gate CSP or auth on this method.

📝 Notes

• Limited availability — mainly Firefox / Gecko; missing in many Chromium and Safari builds.
• Not Experimental / Non-standard; BCD deprecated: false — no status banner required.
• Always returns false when implemented — JS 1.2 tainting is gone.
• Similar learning cousin: javaEnabled().
• Related: unregisterProtocolHandler(), share(), javaEnabled(), canShare().

💡 Best Practices