Chrome Patched a Zero-Day Yesterday, and Your Logs Cannot Tell You Who Still Needs It

Chrome's Stable channel went to 157.0.8103.50/.51 on Monday with nine security fixes. One line in that post is the one that changes your week:

Google is aware that an exploit for CVE-2026-125350 exists in the wild.

So the patch level matters, specifically and immediately. A user on 157.0.8103.49 has a known exploited use-after-free. A user on .51 does not. Same major version, different answer.

Now the uncomfortable part. If you keep browser information in your error tracker, your access logs or your analytics, you probably assume you can segment on that. You cannot, and the reason is a deliberate design decision that shipped years ago and that almost nobody has had cause to notice.

The digits you need were removed on purpose

Chromium's user-agent reduction froze the version. From the rollout plan itself:

Ship reduced Chrome MINOR.BUILD.PATCH version numbers ("0.0.0").

The resulting format is Chrome/<majorVersion>.0.0.0. Every Chrome 157 user on earth sends the same string, whether they are on .49 or .51. The three numbers that distinguish exploited from patched are replaced with zeros before the request leaves the browser.

The operating system went the same way. The reduced string carries fixed literals, Windows NT 10.0; Win64; x64 and Macintosh; Intel Mac OS X 10_15_7, with a footnote that leaves no room:

these strings are literal values; they will not update even if a user is on an updated operating system or device

So the column in your dashboard that says Chrome 157 / Windows 10 is not stale, wrong or badly parsed. It is reporting exactly what arrived, and what arrived cannot answer the question.

What does carry it

The full version still exists, through User-Agent Client Hints. The header is Sec-CH-UA-Full-Version-List, described in Chrome's docs as the "List of browser brands and their full version", and it looks like this:

Sec-CH-UA-Full-Version-List: " Not A;Brand";v="99.0.0.0", "Chromium";v="157.0.8103.51"

In JavaScript the same value comes from a high-entropy request:

const ua = await navigator.userAgentData.getHighEntropyValues(["fullVersionList"])
// ua.fullVersionList -> [{ brand: "Chromium", version: "157.0.8103.51" }, ...]

Both are opt-in. The default set, in Chrome's words, is "the browser brand, significant / major version, platform" and the mobile indicator. The full version is not in it. A server has to ask, with Accept-CH, and even then the docs are explicit that "it's down to the browser what values, if any, are returned".

The bit that actually costs you

Read that again with an incident in mind.

To know today which of your users are on an unpatched build, you needed to have been collecting the full version before today. Accept-CH is a request for future responses. There is no query you can run against last week's logs to recover a value the browser never sent. The data was not lost or truncated. It was never generated.

And it is a Chromium mechanism, so whatever share of your traffic is Safari or Firefox is outside it regardless.

This is the whole shape of the problem, and it is not really about user agents:

The field you need during an incident is one somebody had to decide to collect months before the incident.

Nobody adds Accept-CH: Sec-CH-UA-Full-Version-List on a quiet Tuesday. It gets added the day after the first time somebody needed it and it was not there, which is to say one incident too late. The same is true of the console output, the failed request and the exact build on the machine where a bug actually happened: all of it is free at the moment of the failure and unrecoverable about ten seconds later.

A bug report that says "Chrome 157" is not inaccurate. It is simply not an answer, and this week is the week that difference has a price attached. Most weeks it does not, which is exactly why nobody notices until it does.

What to do before you close the tab

Three things, in descending order of how much they are worth:

1. If you have any legitimate need for patch-level data, send Accept-CH: Sec-CH-UA-Full-Version-List now rather than during the next one. It costs a header.
2. Check what your error tracker actually stores. "Browser: Chrome 157" and "Browser: Chrome 157.0.8103.51" look alike in a list and are not the same record.
3. Update your own browser, then confirm the number rather than the reassuring green text. You want 157.0.8103.50 or later, and the About page is where it is written down.