navigator.oscpu names the same OS family as the user-agent
Check id ua-oscpu-os-family-coherence
What an ordinary browser yields
On Firefox, navigator.oscpu names the same OS family as the user-agent OS token. On non-Gecko engines oscpu is absent and the check does not apply.
What a detector infers
navigator.oscpu is a property only Gecko still exposes — Chromium removed it and WebKit never had it — so this check is silent on every non-Firefox engine and reads nothing there to judge. On Firefox, oscpu and the operating-system token inside the user-agent string are generated from the same compile-time platform constant, which means they cannot name different OS families in a genuine build: a Windows Firefox reports a Windows oscpu, a Mac one a Mac oscpu, a Linux one a Linux oscpu. The one thing that breaks that agreement is a user-agent override that changes the UA string alone — an extension, or the general.useragent.override preference, or an anti-detect browser presenting a Windows identity — while oscpu keeps reporting the real host. That is two Gecko surfaces built from one constant provably disagreeing, and it is a true positive rather than a browser quirk. The comparison is made at OS-family granularity only, never version or architecture, and that restraint is what keeps it honest: Windows 11 reported as Windows 10 stays within the Windows family, Apple Silicon frozen as Intel Mac stays within the Mac family, and Firefox for Android — whose UA says Android while oscpu says Linux armv8l — is normalised into the Linux family before the comparison so it does not split. resistFingerprinting rewrites both surfaces coherently to Windows, or returns an empty oscpu, so it is not-applicable there too.
How to resolve it
oscpu and the UA OS token come from one compile-time constant in Gecko, so they cannot name different OS families in a real Firefox. A UA override has to change oscpu in step — or, better, run the browser on the OS it claims so neither needs rewriting.
Read in the wild by
Camoufox issues
The tracker records UA-override spoofing on a Firefox base where a Gecko-only surface keeps reporting the real host — the shape this reads via oscpu.
daijro/camoufox #516 (UA override coherence)
daijro/camoufox#516Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Navigator identity
- the Keyboard API's presence matches the claimed engine and form factor
keyboard-api-vs-platformThe Keyboard API — navigator.keyboard, with getLayoutMap and lock — ships in desktop Chromium and nowhere else: not in Gecko, not in WebKit… - browser-brand and context hints agree with a fresh realm
brand-hints-vs-realmSome of the cheapest signals to fake are the ones that say which browser this is: navigator.brave exists only in Brave, window.duckduckgo… - location.origin is the serialisation of its own protocol, host and port
location-origin-coherenceAn origin is not stored next to a URL, it is serialised from it: for an http or https document, origin is exactly the scheme, followed by… - navigator.vendor is the constant the measured engine compiles in
navigator-vendor-vs-enginenavigator.vendor is not a preference or a setting — it is a string constant compiled into the engine. - a worker resolves the same IANA timezone as the main thread
worker-main-timezone-coherenceA browser has one host timezone, and the specification ties both the main-thread global and every worker global to it, so a real browser… - the keyboard layout maps the OEM keys the way one real Windows layout would
keyboard-layout-single-originA keyboard layout is not a set of independent key mappings — it is one artifact the operating system hands over whole. - navigator.appVersion is the user agent minus its leading token
appversion-vs-useragentnavigator.appVersion is not an independent fact. In Blink and WebKit it is computed from the User-Agent at read time — literally the UA with… - Trusted Types hands back the branded object its own type demands
trusted-types-value-invariantTrusted Types is a typed API, not a boolean feature flag, and that is the whole of the check.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Navigator identity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Navigator identity — the family ua-oscpu-os-family-coherence belongs to.