This is a follow-up to the following question: Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed?

If I have understood the answers correctly, a website can't determine what OS the user is using if he's running NoScript, so that no Java applets or Javascripts gets executed. The user can still get infected if the exploit-kit is blind-exploiting exploits for several OSs. My follow-up question is the following:

Can you spoof the navigator.oscpu "variable", so that even if the user is having javascript enabled (with or without NoScript), the site gets the wrong information on what OS the user is running? Check this site about the navigator.oscpu: http://www.quirksmode.org/js/detect.html . Assume that the user haven't got Java installed, only javascript enabled.

If the variable is spoofable, would this be enough to escape from most vulnerability-attacks? What other methods can a website use to determine what OS a user is using, except Java applets, javascript and user-agent?

Thanks in advance!

3 Answers 3


Since you're talking about navigator.oscpu, I assume that you're talking about Firefox, because it's the only browser that supports this property.

You can easily spoof the value of navigator.oscpu via the general.oscpu.override preference:

  1. Visit about:config.
  2. Create a new string called general.oscpu.override
  3. Set whatever value you want.

This is not the only way to detect that you're running on Firefox on Windows. There are several Mozilla-specific CSS media queries that can be used to detect whether you're running on Windows, including but not limited to -moz-os-version (Firefox 25+) and -moz-window-theme (Firefox 4+).

Browser plug-ins (such as Flash) can also be used to identify your OS. Either directly (by embedding the plugin) or indirectly, by looping through the navigator.plugins collection, while reading the file names of the plug-ins. To identify Windows, for example, just check whether any of the strings end with .dll. Here's an example that prints the list of filenames: http://jsfiddle.net/A8srr/show.
Note that this issue is going to be resolved in Firefox 28 by making navigator.plugins non-enumerable, see https://bugzilla.mozilla.org/show_bug.cgi?id=757726.

Although you can try to manually fix all properties of navigator (see my recent example for example on spoofing a property of navigator in a user script), do not rely on it for "protecting" your system.

If you want to guard your system against attacks from the web platform, use a virtual machine for browsing the internet (if you're on Windows, you can also try to use Sandboxie, because it integrates better than a separate VM).


Making your browser appear like a different browser to intentionally mislead automatic browser detection is definitely possible. Opera used to have such a feature for years (it got removed when "this website only works with browser X" messages went out of fashion).

But it is unlikely to be a practical protection against web-based exploits, because many infected websites don't care about what browser the user is using and just bombard it with a wide range of exploits for all kinds of browsers without checking which even have a chance to work.

  • Thanks for this answer! But my primary question was about spoofing OS, not browser. For example changing the navigator.oscpu variable. Can that be done, and how?
    – DevRandom
    Jan 1, 2014 at 10:10

You may use appropriate version of Firefox 58+ browser with code name Quantum (by the name of new engine).

Mozilla specs say that such css media queries like "-moz-os-version" and "-moz-windows-theme" have been deprecated.

And even more:


The much longer list of media queries which are not available anymore can be found here. https://developer.mozilla.org/en-US/Firefox/Releases/58

You can test CSS query here to be sure in that.


I would say this is kind a problem resolved by itself which happens not so often by the way.

If your are confused by too much initial RAM while launching this browser you may decrease memory usage from 2 up to 3 times by doing some overrides in about:config

 extensions.webextensions.remote: false
 layers.gpu-process.enabled: false
 browser.tabs.remote.autostart: false
 dom.ipc.processCount: 1

I guess that this is all about prerendering things (tabs) that not always can be useful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .