Browser version is out of date

Scan.now reads the User-Agent string and, where the browser supplies them, the User-Agent Client Hints (Sec-CH-UA-Full-Version-List and navigator.userAgentData.getHighEntropyValues()) to identify the browser family and its full version. That version is compared against a table of current stable releases for Chrome, Firefox (including ESR), Safari, Edge, Opera and Brave that we refresh from each vendor's release notes. The check fails when you are more than one stable release behind, or behind any release that shipped a fix for a vulnerability the vendor reported as exploited in the wild.

Limits: Chromium browsers freeze the minor version in the User-Agent string, so without Client Hints we only know the major version. Safari on iOS reports the operating system version rather than a browser build. A user-agent spoofing extension produces a wrong answer in either direction, and we say so when the string and the Client Hints disagree.

The browser runs untrusted code from every page you open, which makes it the most attacked program on a typical machine. Vendors ship security releases every few weeks and publish the fixed CVE identifiers with them; exploit writers compare the patched and unpatched builds and target whoever has not updated. The urgent cases are fixes marked as exploited in the wild: a booby-trapped page or a malicious advert can run code on an unpatched browser without a click.

The people most exposed are those on machines where auto-update is disabled by policy, browsers left open for weeks (updates download but only apply on restart), and operating systems that vendors no longer ship new browser builds for, such as Windows 7 and 8.1 after Chrome 109.

Update from inside the browser, or from the vendor's own domain. Nowhere else. A page that offers you a browser update is one of the oldest malware delivery tricks there is: fake “your browser is out of date” overlays, poisoned search ads for chrome download, and bundled installers on software-portal sites all deliver real infections. The in-browser update page never leaves your browser and is always the safest route; if you must download an installer, type the vendor's address yourself rather than following a link or an advert.

Chromium browsers download the update in the background and apply it on restart, so an update arrow in the toolbar means a build is already waiting: close every window and reopen. The browser scanner names the page for the browser you are actually using, so you can go straight there.

If the update fails, check whether your operating system is still supported by the browser vendor. If it is not, the real fix is an OS upgrade; Firefox ESR supports some older platforms for longer. On a managed work machine, ask IT why updates are held back. Then rerun the browser scanner. Background: why browser updates matter, the browser security checklist and how CVEs are scored.