navigator.vendor implies an engine that contradicts the UA
br.vendor_vs_ua · convicts
What it catches
CreepJS: navigator.vendor (Google Inc./empty/Apple) must match the UA engine. v0.74.22 iOS FP fix (grounded on the Intoli real-traffic SECOND source — single-source browserforge missed it): the rule convicted real iOS browsers 122/10000. Apple forces WebKit for EVERY iOS browser but navigator.vendor follows the BRAND, so the vendor and UA-engine axes decouple legitimately: real Chrome-iOS (CriOS …Safari/604.1 → ua_engine safari) reports vendor 'Google Inc.' → vendor_engine chromium (107x), and iOS in-app WebViews (no Safari token → ua_engine 'other') report vendor 'Apple…' (7x). Both are real browsers → hard bot FP on a CONVICTING rule. Fix: the collector + calibration no longer EMIT vendor_engine on an iOS UA (/iPhone|iPad|iPod/), so the rule abstains there ('unknown never fires') — narrowing only, never broadening. No coverage lost: an iOS UA-spoof on a Chromium host is still convicted structurally by br.apple_ua_nonwebkit (window.chrome/userAgentData on a claimed-WebKit host). Browserforge calibration is desktop-heavy so its FP rate is unchanged; the Intoli iOS FP drops to 0. Mirrored across demo.py / calibration.py / intoli_corpus.py / livepage/probes.ts. v0.74.23 'unknown never fires' extension (Intoli second-source re-run, refreshed dataset): the residual non-iOS firings were a bare 'AppleWebKit (KHTML, like Gecko)' macOS UA with no browser token → ua_engine 'other' (unclassifiable) and vendor 'Apple Computer, Inc.' → vendor_engine safari, so 'other' != 'safari' convicted what is most likely a real macOS WKWebView. Convicting on a comparison where one operand (the engine) is UNKNOWN violates unknown-never-fires. Fix: vendor_engine is also withheld when ua_engine == 'other', so the rule abstains on an unclassifiable engine. The clear true positive is preserved — a macOS Safari UA reporting vendor 'Google Inc.' stays ua_engine=safari (has the Safari/ token) and still convicts. Same four-site mirror.
Signals it reads
browser.vendor_engine browser.ua_engine
How it fires
not_equal
Evaders it caught 3
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.