v144 · miscellaneous

User-Agent Client Hints "ch-ua-high-entropy-values" permissions policy

Adds support for a 'ch-ua-high-entropy-values' permissions policy that enables a top-level site to restrict which documents are able to collect high-entropy client hints via the navigator.userAgentData.getHighEntropyValues() JS API.

concepts

  1. High-entropy Policy

    Embedders can lock out high-entropy User-Agent Client Hints via Permissions Policy, mirroring the existing low-entropy controls. Tightens fingerprinting surface.

  2. High-entropy Hints Probe

    Request every high-entropy UA hint and surface which came back empty — empty values mean Permissions Policy didn't delegate this hint to this frame.

  3. Policy Builder

    Pick the hints and targets you want; the builder writes the matching Permissions-Policy header and iframe allow= attribute. Live probe against this session shows what's reachable.

  4. Hint Explorer

    A full table of all UA-CH hints — low-entropy (always available) vs high-entropy (require grant) — with live values fetched via getHighEntropyValues() and the required headers for each.

why it shipped

Currently it's only possible to restrict third-party collection of high-entropy User-Agent Client Hints when they're requested over HTTP (via the various permissions policies associated with each Client Hint, i.e., https://wicg.github.io/client-hints-infrastructure/#policy-controlled-features).

references