The 'navigator.oscpu' and 'navigator.productSub' values leak information: Bug 417994 - navigator object does not fully reflect user agent settings.
Also, when Torbutton transitions from an "Enabled" to a "Disabled" state, the 'navigator.oscpu' and 'navigator.productSub' values are not reset to the original values.