UA-CH high-entropy hints cohere with the UA
Check id uach-highentropy
What an ordinary browser yields
fullVersionList's Chrome version matches the UA major, the hinted platform matches the UA's OS, and a Chromium-only brand list — normal on genuine forks — is only flagged when a headless tell (HeadlessChrome UA, webdriver=true, empty plugins/mimeTypes) corroborates it.
What a detector infers
This awaits navigator.userAgentData.getHighEntropyValues and compares the richer hints against the UA string on three axes, collecting every disagreement. First, the Google Chrome / Chromium major inside fullVersionList must equal the UA's Chrome major. Second, the high-entropy platform must equal the OS the UA implies (with an allowance for the Chrome OS / Chromium OS naming variants). Third — a headless-provenance signal rather than a mismatch — the check takes fullVersionList's own brand names, drops the GREASE entries, and considers a bare "Chromium"-only brand set: real Chrome carries "Google Chrome" and Edge/Opera/Brave/Vivaldi carry a vendor brand, so historically that was flagged outright as the Chrome-for-Testing / headless signature. The live corpus showed that rule false-positiving on 100% of genuine desktop Chromium forks (ungoogled-chromium, distro builds), which carry exactly the same brand list — so it now only counts when corroborated by a headless or automation tell: a HeadlessChrome UA, navigator.webdriver=true, or empty plugins/mimeTypes. A fork with no headless tells passes with a note. Note that all three axes read fullVersionList — the low-entropy navigator.userAgentData.brands array is the input to the sibling uach-ua-version check, not to this one. If getHighEntropyValues is unavailable the check returns N/A instead of failing. Severity is warn: the low-entropy hints are the harder evidence, and these are corroborating.
How to resolve it
Populate fullVersionList and platform from the same persona that produces the UA string — those are the two axes scored here (architecture and bitness are reported for context but not tested). If the check flags a bare Chromium brand list, the build also shows a headless tell: drop the HeadlessChrome UA / webdriver flag / empty plugin list rather than editing the brand entry to claim Google Chrome.
Read in the wild by
PerimeterX / HUMAN
Calls navigator.userAgentData.getHighEntropyValues with an eight-hint list — architecture, bitness, brands, mobile, model, platform, platformVersion, uaFullVersion — and ships each hint as its own field in the EV2 payload. It requests the flat uaFullVersion string rather than fullVersionList.
main.min.js (ifood deployment) `navigator[hQ(191)]&&navigator.userAgentData.getHighEntropyValues([hQ(192),t(193),"brands","mobile","model",t(194),"platformVersion","uaFullVersion"]).then((function(t){pj=t}))` — hQ(191)='userAgentData' and hQ(192)='architecture' per the hQ dict; the local base91 dict decodes t(193)='bitness' and t(194)='platform' (the totalwine deployment ships the same eight slots unobfuscated: `["architecture","bitness","brands",im(205),i(206),i(207),"platformVersion","uaFullVersion"]`). Each hint then gets its own EV2 key: `t[0]["a1teUS47XGU="]=pj.architecture,t[0][hQ(871)]=pj.bitness,t[0][hQ(872)]=pj.brands,t[0][hQ(873)]=pj.mobile,t[0]["bHgZcikYGkA="]=pj[hQ(874)],t[0]["R3cyPQIXMQ4="]=pj[hQ(875)],t[0]["BFAxGkEwMio="]=pj[hQ(876)],t[0]["R3cyPQIXMQw="]=pj.uaFullVersion` — captured payload carries "a1teUS47XGU="="x86", "VQEgCxBhIj4="="64", "WGRtbh0Eb1Q="=[{brand:"Chromium",version:"148"},{brand:"Google Chrome",...}], "R3cyPQIXMQ4="="Windows", "BFAxGkEwMio="="15.0.0", "R3cyPQIXMQw="="148.0.7778.168".
DataDome
Ships the full UA-CH high-entropy tuple as one packed field.
R4JwGf = "arm,64,false,,macOS,15.3.1,136.0.7103.114,false"
glizzykingdreko/datadome-encryption — tests/original.jsonEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Navigator identity
- navigator.platform ↔ UA ↔ UA-CH platform agree
platform-coherenceThree independent surfaces each name an operating system, and this check normalises all three to one family (win / ios / mac / lin) and… - UA-CH brand version matches the UA Chrome version
uach-ua-versionThe check extracts the major from Chrome/(\d+) in the UA string, finds the Chrome or Chromium entry in navigator.userAgentData.brands, and… - every brand in a UA-CH list uses the same version format
uach-brand-version-arityUA-CH publishes the same brand set twice at two precisions. navigator.userAgentData.brands carries bare majors like "148", and the… - navigator.language === languages[0]
languages-coherenceIn a real browser navigator.language is defined as the first element of navigator.languages — one preference list, two views onto it. - the host voice roster represents the language the browser claims
locale-vs-voice-coherenceThe voice roster is installed at the operating-system level and the language preference is set in the browser, so the two are genuinely… - eval.toString().length matches the engine (V8 = 33)
etslThe string a JS engine returns for a native function's source is an implementation detail, and its length differs per engine… - navigator.productSub === 20030107 (Chromium)
product-subnavigator.productSub is a frozen legacy constant, not a live value: Chrome, Safari and Opera return "20030107" while Firefox returns… - a Firefox user-agent reports the Gecko productSub constant 20100101
gecko-productsub-hardcodenavigator.productSub is a constant compiled into the engine, and the two families disagree: every Gecko build hardcodes it to "20100101"…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Navigator identity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Navigator identity — the family uach-highentropy belongs to.