Skip to content
Anti-Bot

What Is Sec-CH-UA-Full-Version-List? Why Chrome's Full Version Must Fit the Platform

Pim

Pim · Scrappey Research

October 28, 2026 3 min read

What Is Sec-CH-UA-Full-Version-List? Why Chrome's Full Version Must Fit the Platform — conceptual illustration
On this page

Sec-CH-UA-Full-Version-List is the User-Agent Client Hint that carries Chrome's full build number, such as 156.0.8078.73, for each browser brand. Since User-Agent reduction, the User-Agent string only carries the major version (Chrome/156.0.0.0), so the full build moved to this header and to navigator.userAgentData.getHighEntropyValues(['fullVersionList']). A Chrome major version is many builds, shipped at different times on different platforms, so a full version can contradict the platform, the date or the engine it claims to run on.

Quick facts

HTTP headerSec-CH-UA-Full-Version-List (sent after the server asks with Accept-CH)
JavaScriptnavigator.userAgentData.getHighEntropyValues(['fullVersionList'])
User-Agent stringMajor version only: Chrome/156.0.0.0
Chrome 156, first two weeks8 Windows stable builds, 2 Linux builds (.47 and .73)
Brands listedA GREASE brand, Chromium and Google Chrome, each with a version

Where the build number went

Chrome's User-Agent used to carry the full build, for example Chrome/156.0.8078.73. Since User-Agent reduction it carries the major version followed by zeros. The detail moved to User-Agent Client Hints: a server that sends Accept-CH: Sec-CH-UA-Full-Version-List receives the header on later requests, and any page can ask for it in JavaScript without permission.

Challenge scripts do ask. One widely deployed widget requests fullVersionList together with architecture, bitness, formFactor, model and platformVersion in a single call. The build number still matters; it is just one call away instead of in every request.

One major version, many builds

Chrome ships several stable builds per major version, and not every platform gets every build. Chrome 156 in its first two weeks (October 2026, from the public release listings):

PlatformStable builds
Windows156.0.8078.35, .36, .47, .48, .49, .73, .74, plus an early 157.0.8103.15
macOS.35, .36, .47, .48, .49, .73, .74
Linux.47 and .73 only
Android.39, .47, .48, .49, .73, plus an early 157.0.8103.14

Updates roll out gradually, so on any given day the real population on a platform is a mix of the last few builds, weighted toward the newest.

What a full version can contradict

  • The platform. Chrome on Linux reporting 156.0.8078.74 is impossible; that build never shipped on Linux.
  • The date. A build superseded weeks ago describes a user who has not restarted the browser in a long time. Possible for one user, implausible for a whole fleet pinned to the same old build.
  • The engine. Each build has a known V8 version and behaviour, so the number also has to fit what the page measures directly; see engine and OS oracle fingerprinting.
  • The other brands. The Chromium and Google Chrome entries have to agree with each other, and the GREASE brand and brand order have to match what that major generates.

A browser that reports its own build is consistent with its engine automatically but ages as Google ships patches. Anything that sets the version by hand, such as a user agent rotation list, has to pick a build that shipped on the claimed platform recently and keep it in step with the engine. A managed web data API that keeps its browsers on current builds avoids carrying that table at all.

Code example

javascript
// Read the full version list and check it against the platform.
// Run in Chrome's console.
const hints = await navigator.userAgentData.getHighEntropyValues([
  'fullVersionList', 'platform', 'platformVersion', 'architecture', 'bitness'
]);
console.log(navigator.userAgent);        // ... Chrome/156.0.0.0 ...
console.table(hints.fullVersionList);    // GREASE brand, Chromium, Google Chrome

// Stable builds per platform for Chrome 156's first two weeks (Oct 2026).
const SHIPPED = {
  Windows: ['156.0.8078.35', '156.0.8078.36', '156.0.8078.47', '156.0.8078.48',
            '156.0.8078.49', '156.0.8078.73', '156.0.8078.74'],
  macOS:   ['156.0.8078.35', '156.0.8078.36', '156.0.8078.47', '156.0.8078.48',
            '156.0.8078.49', '156.0.8078.73', '156.0.8078.74'],
  Linux:   ['156.0.8078.47', '156.0.8078.73'],
};

const chrome = hints.fullVersionList.find(b => b.brand === 'Google Chrome');
const chromium = hints.fullVersionList.find(b => b.brand === 'Chromium');
const known = SHIPPED[hints.platform] || [];
console.log({
  platform: hints.platform,
  version: chrome?.version,
  brandsAgree: chrome?.version === chromium?.version,
  shippedOnPlatform: !chrome?.version.startsWith('156.') || known.includes(chrome.version),
});

Related terms

What Is Client Hints Fingerprinting?
User-Agent Client Hints (UA-CH) are a set of structured HTTP headers plus a matching JavaScript API that report the same browser and operati…
What Is Engine/OS Oracle Fingerprinting?
An engine or OS oracle is a small, incidental observable whose value is fixed by the JavaScript engine or the host operating system, and whi…
What Is a User Agent?
A user agent is a short text string a client sends in the User-Agent HTTP header to tell a server what software is making the request. Every…
What Is Header Order Fingerprinting?
Header order fingerprinting checks whether the headers on a request, their order and their values match what a real browser sends for that k…
What Is Cross-API Coherence Checking?
Cross-API coherence checking is a detection method that asks the browser the same question through two or more independent APIs and compares…
What Is Browser Fingerprinting?
Browser fingerprinting is a technique that identifies and tracks a visitor by combining dozens of small, observable characteristics of their…
Concept map

Concept map

How Sec-CH-UA-Full-Version-List connects

The terms most directly tied to this one. Hover a node to see its neighbours, click to preview, drag to rearrange.

0 terms · 0 connections
You are here · Anti-Bot
Building map…

Tools & solutions for this topic

Frequently asked questions

Why does the Chrome User-Agent end in .0.0.0?

Because of User-Agent reduction. Chrome freezes the minor, build and patch parts of the version in the User-Agent string to reduce passive fingerprinting. The full build is still available through the Sec-CH-UA-Full-Version-List client hint and navigator.userAgentData.getHighEntropyValues.

Does every platform get the same Chrome builds?

No. In Chrome 156's first two weeks, Windows and macOS received seven 156 builds while Linux received only two (156.0.8078.47 and .73). A Linux session that reports a Windows-only build is reporting a version that does not exist on its platform.

Which Chrome version should a scraper report?

Ideally the one it actually runs, on a build that is current. If a version has to be set, it should be a build that shipped on the claimed platform recently, with an engine that behaves like that build, and it has to be updated as new builds ship.

Last updated: 2026-10-28 · Facts last verified: 2026-10-28