Browser Fingerprinting on Samsung Galaxy (Chrome)

Browser Fingerprinting on Samsung Galaxy (Chrome)

Chrome on this Galaxy phone sends a frozen, generic User-Agent header on every request by default, part of Google's User-Agent Reduction rollout meant to cut down on passive fingerprinting from server logs.¹ That header reduction covers what a server sees automatically; it says nothing about what a page's own JavaScript can still ask for. This device already exposes real hardware values through other APIs regardless: navigator.deviceMemory returns this phone's actual RAM tier and the WebGL renderer string names its exact GPU chipset, both untouched by the User-Agent change.

Specifications

The User-Agent header looks generic, but this Galaxy still hands over its model

Chrome's User-Agent Reduction effort replaced the old, detailed User-Agent string with a standardized format that omits the exact Android build and device model by default.¹ On paper that sounds like a meaningful privacy improvement, and for passive server-side header logging, it is one. What it does not do is stop a page's own script from asking for the same information through a different, still-available API, which is exactly what this Galaxy phone's Chrome build allows.

The frozen header only covers passive logging

A server that only inspects the raw User-Agent request header on this device sees a generic Android and Chrome version string with no mention of "Galaxy" or a specific model number. That is a genuine improvement over the pre-reduction format, which used to spell out the device model directly in every request. But the reduction is a change to what gets sent automatically by default, not a restriction on what a page is permitted to ask for once it has loaded and started running its own JavaScript.

Sec-CH-UA-Model is one JS call away, no prompt required

Calling navigator.userAgentData.getHighEntropyValues(['model', 'platformVersion']) from any script running on this page returns the real device model and platform version.² Access is governed by a Permissions-Policy header the site itself sets, not by a permission dialog shown to you the way camera or microphone access would be. In practice, a site that wants this Galaxy's exact model just asks for it in a single async call, and the reduced default header never enters the picture at all.

Why the hardware APIs matter more here than the header ever did

Even setting Client Hints aside entirely, this Galaxy's Chrome already exposes real hardware values through separate JavaScript APIs that the User-Agent reduction never touched. navigator.deviceMemory returns this phone's actual RAM class rather than a randomized placeholder, and the WebGL renderer string names the exact GPU chipset driving the display.³⁴ Neither API reads from the User-Agent header, so reducing that header has no effect on either one.

The GPU renderer string alone narrows this phone's population

Querying UNMASKED_RENDERER_WEBGL on this device returns a string in the form "Adreno (TM) 750," directly naming the Qualcomm chipset inside it, the same behavior CapyToolkit's own Android Chrome guide documents for Galaxy hardware generally.³ Combined with the real RAM tier from deviceMemory, a script can classify this phone's performance tier and chipset family without ever touching the frozen User-Agent string or asking for a single Client Hint, which is why the header reduction alone is a smaller privacy win on this specific configuration than it might first appear.⁵

Two phones marketed under the same Galaxy model name can still ship with different chipset revisions across regions or production runs, and the renderer string reveals that difference directly where a rounded model name would not. That is a meaningful narrowing signal on top of whatever the model string itself already provides, independent of anything the User-Agent header does or doesn't send. Combining the renderer string with the RAM tier from deviceMemory and the screen dimensions reported through screen.width and screen.height gives a script three independently sourced hardware values to cross-reference, none of which the User-Agent reduction was ever designed to touch in the first place.