[Privacy Alert] Firefox Mobile leaks native language in HTTP_ACCEPT headers even with RFP enabled and VPN active

A persistent privacy leak related to HTTP_ACCEPT Headers that bypasses VPNs and advanced privacy configurations.

Even with a VPN active and Privacy Resist Fingerprinting (RFP) set to true, the browser continues to leak the native system language (in my case, pt-BR). This significantly compromises anonymity and strengthens the browser fingerprint.

The header looks like this:

text/html, */*; q=0.01 gzip, deflate en-US,pt-BR;q=0.9

The Issue:

The browser constantly resets the preference intl.accept_languages. Even if you manually change it to en-US in about:config, it reverts back to en-US,pt-BR after a restart if you are physically in Brazil.

I have already tried the following, but none solved the issue:

Setting privacy.spoof_english to 2.

Enabling all Fingerprinting related flags to True.

Manually overriding intl.accept_languages.

Mozilla needs to make intl.accept_languages a persistent setting that doesn't reset automatically. This leak happens even when not logged into any services and while using a VPN to hide the IP.

My Fingerprinting Results (EFF Cover Your Tracks):

Despite this leak, my setup is quite strong:

“Only one in 81,460 browsers have the same fingerprint as yours.”

“Your browser has a fingerprint that conveys 16.31 bits of identifying information.”

While 16.31 bits is much better than the average 18+ bits, the language leak is a critical flaw. Websites can see you are in Brazil (BR) via headers even if your IP and DNS point to another country.

This directly impacts privacy and anonymity. Even users who use a VPN to hide their location end up being exposed because their native language is leaked.