Chrome's hidden X-Browser-Validation header reverse engineered

Comments (3)

cebert · 1d ago

I have to imagine Google added these headers to make it easier for them to identify agentic requests vs human requests. What angers me is that this is yet another signal that can be used to uniquely fingerprint users.

dsekz · 1d ago

Dug into chrome.dll and figured out how the x-browser-validation header is generated. Full write up and PoC code here: https://github.com/dsekz/chrome-x-browser-validation-header

Why do you think Chrome bothers with this extra headers. Anti-spoofing, bot detection, integrity or something else?

twapi · 1d ago

Seems like they are using these headers only for google.com requests.

Adding a feature because ChatGPT incorrectly thinks it exists (holovaty.com)

Nvidia won, we all lost (blog.sebin-nyshkim.net)

Bootstrapping a side project into a profitable seven-figure business (projectionlab.com)

My open source project was relicensed by a YC company [license updated] (twitter.com)

Local-first software (2019) (inkandswitch.com)

Introducing tmux-rs (richardscollin.github.io)

Supabase MCP can leak your entire SQL database (generalanalysis.com)

Bitchat – A decentralized messaging app that works over Bluetooth mesh networks (github.com)

Being too ambitious is a clever form of self-sabotage (maalvika.substack.com)

OpenAI’s Windsurf deal is off, and Windsurf’s CEO is going to Google (theverge.com)

Measuring the impact of AI on experienced open-source developer productivity (metr.org)

Are we the baddies? (geohot.github.io)

Grok: Searching X for "From:Elonmusk (Israel or Palestine or Hamas or Gaza)" (simonwillison.net)

The Rise of Whatever (eev.ee)

At Least 13 People Died by Suicide Amid U.K. Post Office Scandal, Report Says (nytimes.com)

Websites hosting major US climate reports taken down (apnews.com)

US Court nullifies FTC requirement for click-to-cancel (arstechnica.com)

Tree Borrows (plf.inf.ethz.ch)

Mercury: Ultra-fast language models based on diffusion (arxiv.org)

Hidden interface controls that affect usability (interactions.acm.org)

Postgres LISTEN/NOTIFY does not scale (recall.ai)

Linda Yaccarino is leaving X (nytimes.com)

Nobody has a personality anymore: we are products with labels (freyaindia.co.uk)

I extracted the safety filters from Apple Intelligence models (github.com)

I used o3 to profile myself from my saved Pocket links (noperator.dev)

SVGs that feel like GIFs (koaning.io)

Open letter accuses BBC board member of having a conflict of interest on Gaza (theguardian.com)

Jane Street barred from Indian markets as regulator freezes $566M (cnbc.com)

Show HN: I wrote a "web OS" based on the Apple Lisa's UI, with 1-bit graphics (alpha.lisagui.com)

ETH Zurich and EPFL to release a LLM developed on public infrastructure (ethz.ch)

Anthropic cut up millions of used books, and downloaded 7M pirated ones – judge (businessinsider.com)

Major reversal in ocean circulation detected in the Southern Ocean (icm.csic.es)

A non-anthropomorphized view of LLMs (addxorrol.blogspot.com)

Show HN: Pangolin – Open source alternative to Cloudflare Tunnels (github.com)

Google can now read your WhatsApp messages (neowin.net)

The force-feeding of AI features on an unwilling public (honest-broker.com)

Mini NASes marry NVMe to Intel's efficient chip (jeffgeerling.com)

Hannah Cairo: 17-year-old teen refutes a math conjecture proposed 40 years ago (english.elpais.com)

Grok 4 Launch [video] (twitter.com)

New sphere-packing record stems from an unexpected source (quantamagazine.org)

OBBB signed: Reinstates immediate expensing for U.S.-based R&D (kbkg.com)

Bill Atkinson's psychedelic user interface (patternproject.substack.com)

The jank programming language (jank-lang.org)

IKEA ditches Zigbee for Thread going all in on Matter smart homes (theverge.com)

The death of partying in the USA (derekthompson.org)

What a Hacker Stole from Me (mynoise.net)

Smollm3: Smol, multilingual, long-context reasoner LLM (huggingface.co)

Apple vs the Law (formularsumo.co.uk)

Why I left my tech job to work on chronic pain (sailhealth.substack.com)

How to Network as an Introvert (aginfer.bearblog.dev)

Chrome's hidden X-Browser-Validation header reverse engineered

Comments (3)