How can I reliably detect the browser without using window.navigator?

I know there are a thousand questions on Stack Overflow about detecting the browser with JavaScript. My question is how can you detect the browser without window.navigator (which includes navigator.userAgent)?

First, to clarify, I don't need to know the rendering engine, this isn't for adaptive layout, and don't panic: I'm already doing feature detection. If why I'm asking about detecting the browser is important, please comment and I'll be happy to splice in the explanation, but it will probably make the question egregiously long.

Next, let me describe why my question is not a duplicate of:

• Browser detection in Javascript? because of 19 answers, 12 of them use navigator.userAgent specifically (including jQuery.browser which used userAgent, and is now gone anyway), 4 use navigator.appName (which gives "Netscape" in Chrome...), 1 side-steps the question by recommending feature detection, which is different from browser detection (I am already using feature detection, but to know the extent to which I can use them, I need browser detection), and 2 aren't really answers or are IE-specific. (Although this non-answer is actually very explanatory about why my question here is relevant: I'm trying to avoid hitting pain points on certain browsers that would crash the tab!) Since my question is asking for an answer (even a hack?) without using window.navigator, it is not a duplicate of that question.

• Check if the user is using IE because of 11 answers, 10 use navigator.userAgent and 1 of them uses an IE trick to detect IE only, which is not sufficient to answer my question (though it may be potentially be a small part of a helpful solution posted here)?

• In Javascript, how do I determine if my current browser is Firefox on a computer vs everything else? because of 11 answers, 8 use navigator.userAgent, 2 recommend feature detection (again, not my question), and 1 isn't even an answer, really.

• How to detect chrome and safari browser (webkit) because of 8 answers, 6 of them use navigator.userAgent, and 2 are webkit-specific. Unfortunately, WebKit is not necessarily tied to just Safari, and I need to know the browser, not the rendering engine.

Hopefully that is crystal clear.

I know there are other ways to do this, but I don't know the ins-and-outs of each browser well enough. Are there objects or variables that are consistently or reliably exposed to JavaScript in certain browsers, maybe? I know that some experimental APIs are vendor-prefixed, but that doesn't seem like a good idea for use in a commercial product, although I'm willing to stoop that low if needed. Any other possibilities?

A thought:

• IE uses ActiveX (still does up to IE11, legacy), You can fairly easy deduce the fact that the user is using IE from looking at activeX availability, however if the security settings are on, you need to fall back on, guess what, other feature detection.
• Chrome and Firefox both support the use of extensions, maybe detecting these extensions will help
• Chrome has the window['chrome']['webstore'] object available in the global scope.
• You can sort through the window object with Object.keys and look for vendor specific names like 'moz' or 'ms' or 'o'.

If you combine moz, ms and chrome-object you can sniff out the three largest browsers.

On a side note, feature detection is still the best option, not for the OP, but for the "I'm-just-getting-into-programming-and-I-like-to-know-how-I-sniff-out-a-browser-programmers" out there.