iOS UA reports a screen larger than any real iPhone/iPad
br.ios_screen_oversized · convicts
What it catches
Spatial DEVICE<->screen coherence — the joint-manifold half of FP-Inconsistent (ACM IMC 2025) / radar G1/X5 that br.mobile_no_touch's DB-free form does not cover. An iOS UA (iPhone/iPad/iPod) names a specific hardware family whose LOGICAL screen is a device-fixed property; the Apple device-screen corpus (iosref.com/res, ios-resolution.com: 137 iPhones + 52 iPads) bounds it — the LARGEST real iOS logical screen is the iPad Pro 12.9" at 1024x1366, so no real iPhone/iPad exceeds ~1376 CSS px in EITHER dimension. An iOS UA whose max(screen.width, screen.height) > 1400 is therefore a DESKTOP screen wearing an iPhone/iPad UA — the touch-faking mobile spoof that beats br.mobile_no_touch (sets maxTouchPoints>0 via CDP Emulation.setTouchEmulation) but forgets to shrink screen.width/height to a real iOS geometry. The joint-coherence RATCHET: it forces the spoofer to get the SCREEN right too, not just touch. FP-SAFE by the hard hardware bound (data-grounded on the real Apple screen set; screen.width/height is device-fixed, unaffected by Safari UI chrome / split-view which only change innerWidth); convicts a desktop-faking-iOS whatever its touch spoof. The exact per-model SET check (an off-manifold screen BELOW 1400, e.g. 1280x800 under an iOS UA) needs the maintained device DB and is FP-riskier on new models — this ships the bulletproof oversized slice; the full-set version is the data-driven extension (X5). GROUNDED LIVE: a real headful Chromium given an iPhone UA on a desktop-screen container emits ios_screen_oversized (max screen dim >> 1400); a coherent iOS profile with a real iPhone screen (<=1376) does NOT — the coherent-randomizer evasion the vision requires.
Signals it reads
browser.ios_screen_oversized
How it fires
present
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.