Installed fonts
Which fonts your browser exposes, and whether the set matches the operating system your User-Agent claims. Fonts come from the OS, not the browser.
What to do about it
Fonts contradict the OS
Fonts come from the operating system under the browser. Run the browser on the OS it claims, or use a build that masks enumeration to that OS's font list — including the signature fonts, not just the web-safe ones.
Mixed sets
Office, Adobe and Wine bring foreign fonts to real machines too, but a Linux box with twelve Windows fonts and no Segoe UI is memorable. Keep the set small and plausible.
Too few fonts
A browser that exposes only web-safe fonts looks like a container or a hardened build. Real desktops have dozens of system fonts.
Metrics
Even with the same font list, text widths differ between OS rasterisers and versions. The metrics hash is a stable identifier of this machine on its own.
How this test works
A test string is measured in the generic monospace, sans-serif and serif faces, then again with each candidate family in front of them. If the width changes, the browser found the font. Every detected font is attributed to the systems and packages that ship it; the counts of signature fonts per OS are compared with the OS the User-Agent claims.