The fix, in one snippet
Sec-CH-UA: "Chromium";v="128", "Not;A=Brand";v="24"
Sec-CH-UA-Platform: "macOS"Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan page is served with Accept-CH: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-UA-Bitness. We inspect the headers on the following request and, in JavaScript, call navigator.userAgentData.getHighEntropyValues() with the same list. We report what came back and compare it with the frozen User-Agent string. Chromium browsers (Chrome, Edge, Opera, Brave) implement User-Agent Client Hints and hand the high-entropy values to any first-party origin that asks, with no prompt; Firefox and Safari do not implement the API and pass this check by default. The check is informational.
Why it matters
When Chrome reduced the User-Agent string in 2022 and 2023, the detail did not disappear; it moved into Client Hints where a site must ask for it. The full browser version, the platform version (which distinguishes Windows 10 from 11), the device model on Android (for example Pixel 8) and the architecture each add bits to your fingerprint. The exact version also tells an exploit kit which bugs still work in your build, which is why staying current matters more than hiding the number. Android users, whose model string is exposed, gain the most identifying bits.
How to fix it
There is no Chrome or Edge setting that refuses Client Hints, and extensions cannot fully block the JavaScript API. Brave reduces what it returns; Firefox and Safari do not send them at all. The practical advice is to keep the browser updated so version disclosure has nothing to point at, and to use fingerprinting protections for the rest. Site owners should only request the hints they need and can stop third parties from receiving them with a Permissions-Policy header:
Permissions-Policy: ch-ua-model=(), ch-ua-platform-version=()Background: browser fingerprinting explained.
Where this fits
User-Agent Client Hints exposure is check 16 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits JavaScript disabled (info), where javaScript is off in your browser, so the client-side parts of this scan could not run. An attacker who has that does not need this, so it is the better use of the same hour.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: User-Agent Client Hints exposure (info severity)
Scanner check id: client-hints-exposureThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
