Because Torbutton overrides the 'window.navigator' object in JavaScript, the builtin XPCNativeWrapper can be used to retrieve the native 'window' object and read the original 'navigtor.oscpu', 'navigator.buildID' and 'navigator.productSub' values. The 'delete' operator can be used to reveal original XPCNativeWrapper.