Sec-CH-UA

Sec-CH-UA is the headline hint: which browser is talking, by brand, with major version only. It is classified as low entropy, so Chromium attaches it to every single request (page loads, fetches, images) without your server asking for anything.

Reading the value

The value is an HTTP structured-field list of brand/version pairs:

Sec-CH-UA: "Chromium";v="126", "Not/A)Brand";v="8", "Google Chrome";v="126"

Three things trip up first-time parsers:

• One entry is fake on purpose. Browsers inject a GREASE brand like "Not/A)Brand" or ";Not A Brand" with junk punctuation, precisely so lazy parsers break early and often. Never match on list position; look up the brand you care about.
• Order is randomized. Chrome shuffles brand order between versions. Sec-CH-UA is a set, not a sequence.
• Chromium derivatives report multiple real brands. Edge sends "Microsoft Edge" alongside "Chromium"; Brave deliberately reports only "Chromium". Equivalence classes, not exact strings.

Major version only is a privacy feature: full build numbers are high-entropy and live in Sec-CH-UA-Full-Version-List behind an Accept-CH opt-in.

In JavaScript

navigator.userAgentData.brands
// [{ brand: "Chromium", version: "126" },
//  { brand: "Not/A)Brand", version: "8" },
//  { brand: "Google Chrome", version: "126" }]

Who sends it

Chromium-family browsers only (Chrome, Edge, Opera, Brave, Samsung Internet, Android WebView). Firefox and Safari send nothing: no Sec-CH-UA, no navigator.userAgentData. Any server-side logic keyed on this header needs a fallback to classic User-Agent parsing for roughly a third of web traffic.