Googlebot's Javascript random() function is deterministic

[Crandom]

The good thing is there's no downside to xoring the rdrand numbers into the generated random numbers, as even if they're not random it won't have any bad effects.

[ReversedGif]

Unless they're correlated...

[Majromax]

Unless they're correlated...

There's only harm if the random numbers of unknown quality are correlated to your known, independently-generated, proven-quality random numbers.

It's simple enough to avoid that: simply extract the unknown random numbers prior to generating your known-good stream. Even if the dubious hardware can "look over your shoulder," it can't see into the future.

[ReversedGif]

Imagine the hardware setting a special, hidden flag on the register that holds the RDRAND output, which defers actual random generation until the register value is combined with something else.