Sec-CH-UASec-CH-UA is the flagship User-Agent Client Hints header, conveying the browser's brands and major versions in a structured form. It is a low-entropy hint (sent by default) meant to replace the long, easily spoofed traditional User-Agent string.
The value is a Structured Fields list where each item is a "brand";v="version" pair, e.g. "Chromium";v="120", "Google Chrome";v="120", "Not?A_Brand";v="24". An entry like Not?A_Brand is GREASE, an intentional fake inserted so server parsers handle unknown brands rather than ignoring them. Its string, punctuation, and order can vary by browser and version, so avoid hardcoded matching.
Sec-CH-UA is a low-entropy hint and is sent by default without an Accept-CH opt-in. However, it carries only brands and 'major versions'; high-entropy details like full version, platform version, or device model are split into Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, and Sec-CH-UA-Model, which you must request explicitly via Accept-CH.
Sec-prefixed hints are browser-managed 'forbidden headers' that JavaScript cannot set or manipulate, so they are trustworthy. Servers should parse the value for feature branching and analytics but, when exact version comparison is needed, judge by the major version only or opt into Full-Version-List.
Sec-CH-UA: "<brand>";v="<version>"[, "<brand>";v="<version>"]*e.g. Sec-CH-UA: "Chromium";v="120", "Google Chrome";v="120", "Not?A_Brand";v="24"
"<brand>";v="<version>" | A pair of brand name and its major version; multiple brands are comma-separated. |
"Not?A_Brand";v="..." | A GREASE entry: an intentional fake brand so parsers tolerate arbitrary brands (its value varies by browser). |