Check a handoff by its contents
The browser records a SHA-256 hash and exact byte size for every selected file. Duplicate names receive numbers in the manifest; generic names can replace all source names. Source files themselves are not renamed or changed.
Verification matches files by size and hash, so a changed filename does not break a valid handoff. Every manifest entry requires a matching selected file. Duplicate contents are counted separately. A missing or changed file produces a mismatch report.
A matching manifest is evidence that these bytes agree with that manifest. It does not prove who created or sent the files. An attacker replacing both the files and the manifest can generate matching hashes. Manifests also reveal file sizes and hashes, which can identify known files.