navigator.oscpu implies an OS that contradicts the UA platform
br.oscpu_vs_ua · convicts
What it catches
Firefox navigator.oscpu OS vs UA platform (engine-agnostic). A Firefox-only surface: a naive OS/geo spoof overrides navigator.userAgent but leaves navigator.oscpu at the real host value. v0.71.1: OS-family resolution (Android↔Linux) applied before comparison, matching navplatform_vs_ua — Firefox on Android reports oscpu "Linux armv8l" under an Android UA, which is genuine. v0.74.16 FIRST LIVE POSITIVE: the new firefox-os-spoof evader (Playwright Firefox under a Windows UA, oscpu left at the real "Linux x86_64") fires it — oscpu_os=Linux vs ua_platform=Windows. Previously 'evaded' (the Chromium fleet has no navigator.oscpu, so no evader exercised this Firefox-only tell). GROUNDED FP-safe across the real-browser second source: the headful Firefox capture has oscpu_os==ua_platform (Linux/Linux → no fire), so a real Firefox cannot trip it. Browserforge Firefox fingerprints derive oscpu coherently with the UA, so it cannot raise the legit flag rate.
Signals it reads
browser.oscpu_os browser.ua_platform
How it fires
not_equal
Evaders it caught 1
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.