[Compare](https://cdpfleet.com/docs/compare) / versions

# Chrome 154 vs Chrome 153

What changed between the two Chrome majors on the fleet — new features, removals, the new HTTP warning and why automated sessions don't see it — and which of it a site can use to tell a browser's version, or to tell that the version is a lie.

[Google Chrome](https://cdpfleet.com/docs/browsers/chrome)

Chrome 153 went stable on 8 September 2026 and 154 on 22 September. The fleet runs 154 as `stable` and keeps 153 as a pinned previous major (`{"version": "153"}`) until it rotates out; 155 and 157 are available as `beta` and `dev`. Below: what Google shipped and removed in each, what we could measure as different from inside a page and on the wire, which of those differences matter for detection, and what can be configured — by you in the launch, by us on the fleet, or by nobody.

## What 154 adds

From the Chrome 154 release notes. Items marked **measured** show up in the probe table below.

-   **JavaScript:** `Iterator.prototype.includes` (**measured**: present in 154, absent in 153); the JavaScript Self-Profiling API in dedicated workers.
-   **CSS and layout:** `scroll-marker-group` gets `links` and `tabs` modes; `text-decoration-inset` for the start and end of underlines; `FontFace.width` and the `font-width` descriptor as aliases for `stretch` (**measured**); `CSSStyleValue` available in workers; responsively-sized `<iframe>`; popovers and dialogs light-dismiss on `click` instead of pointer events, so scrolling no longer closes them.
-   **Network:** the `WebSocket` constructor takes an options dictionary (`{ protocols }`, an extension point for later options) and a `targetAddressSpace` for local destinations; a fetch's abort reason is forwarded to `Response` methods and streams; Background Fetch now enforces CORS and needs the Local Network Access permission for local servers.
-   **Security and privacy:** **Ask before HTTP is on by default** — Chrome warns before loading a plain `http://` page; administrators control it with the `HttpsOnlyMode` policy. **Measured:** the warning did not appear in a fleet session — a plain-HTTP JSON endpoint loaded directly in both versions, because Playwright launches Chromium with the `HttpsUpgrades` feature disabled (see below). Secure Payment Confirmation validates the dialog locale. Origin trial: Private Verification Tokens, which carry a site's trust in a user into Incognito to reduce CAPTCHA friction.
-   **Service workers and devices:** an opt-in `ServiceWorkerAutoPreload` mode that sends the network request in parallel with service-worker startup; WebHID listed for this release.

## What 153 added, and what it took away

-   **Added in 153:** single-axis scroll containers (`overflow` with `clip` on one axis), `scroll-axis-lock`, declarative `<camera>` and `<microphone>` capability elements (**measured**: present in both), `Iterator.prototype.join` and `Iterator.zip` (**measured**: both), IAMF spatial-audio decoding, `renderSizeHint` for `AudioContext`, the WebGPU `buffer_view` WGSL feature, XML parsing moved to a memory-safe Rust parser, JS Self-Profiling markers (origin trial).
-   **Deprecated or removed from 153 on:** the Privacy Sandbox advertising APIs — Protected Audience, Shared Storage, Attribution Reporting, Related Website Sets and `document.requestStorageAccessFor` — and the non-standard `_current` navigation target. **Measured:** `document.requestStorageAccessFor` is still a function in 153 and gone in 154; `navigator.joinAdInterestGroup` and `document.browsingTopics` were still present in both at measurement time; `window.sharedStorage` and `window.attributionReporting` were absent in both.

## What is identical

Everything on the wire. JA4, the peetprint, the Akamai HTTP/2 fingerprint, cipher and extension counts and the header order are byte-for-byte the same in 153 and 154 (the JA3 hash differs between any two Chrome runs because of GREASE randomisation — never use it to compare builds). Canvas output, WebGL strings, screen, window metrics, plugins, permissions and `navigator.webdriver` (false on the fleet) are also identical. Only the host's core count differs, and that is the fleet node, not the version.

## What affects detection

-   **The version is declared in four places and they must agree:** the reduced user agent (`Chrome/154.0.0.0`), the `sec-ch-ua` brands header, `navigator.userAgentData.brands` and the high-entropy `fullVersionList`. 154 also changes the GREASE brand token and its position (`Not A(Brand;99` first in 154, `Not_A Brand;8` second in 153). Spoofing the UA string alone leaves the client hints and `fullVersionList` on the old version — a one-line inconsistency check. Run the real version instead: both are a launch option here.
-   **Feature presence is a version fingerprint:** `Iterator.prototype.includes`, `FontFace.width` and the disappearance of `document.requestStorageAccessFor` separate 154 from 153 without reading any header. A "Chrome 154" user agent on a 153 engine (or an older Chromium build) fails this silently.
-   **Plain-HTTP targets keep working.** A hand-launched Chrome 154 stops at a warning page before loading `http://` sites; an automated one on the fleet does not (**measured**: `http://ip-api.com/json` loaded directly in 154 and 153), because Playwright starts Chromium with `--disable-features=…HttpsUpgrades…`. A site can't see the difference from inside a page; a one-off `http://` navigation that \*isn't\* warned about is only visible to someone watching the browser.
-   **Private Verification Tokens** (origin trial) is Google's own answer to "trusted user, fresh profile" — relevant to anyone whose problem is CAPTCHA friction on clean sessions, not available to automation.
-   **Nothing changed at the TLS or HTTP/2 layer**, so anti-bot systems that keyed on Chrome 153's JA4 keep matching 154; only JS-level version checks move.

## Configurable — by you, by us, by nobody

| Item | Who controls it | How |
| --- | --- | --- |
| Which major runs | You | `version: "153"` while it is pinned on the fleet; `channel: "beta"` / `"dev"` for 155 and 157; omit both for stable. See [Chrome](https://cdpfleet.com/docs/browsers/chrome). |
| Ask before HTTP (the `http://` warning page) | Playwright / cdpfleet | Already off for fleet sessions: Playwright's launcher disables Chromium's `HttpsUpgrades` feature (measured: no warning in 154). The `HttpsOnlyMode` enterprise policy is the supported switch if Chrome ever stops honouring the flag; only the fleet can set it. Nothing for you to do; `http://` targets load as in 153. |
| Local Network Access permission (Background Fetch to local servers) | Not relevant on the fleet | The browser runs on our servers; "local" is our network, which sessions cannot reach. |
| `ServiceWorkerAutoPreload` | The site | Opt-in by the site's service worker; nothing to set on the browser. |
| `WebSocket` options and `targetAddressSpace` | Page scripts | New API surface, available to any script you run in the page. |
| Privacy Sandbox APIs (`requestStorageAccessFor`, Protected Audience, Shared Storage, Attribution Reporting) | Nobody | Removed or being removed from Chromium; no flag or policy brings `document.requestStorageAccessFor` back in 154. Sites that relied on it fall back to the Storage Access API prompt. |
| `_current` navigation target | Nobody | Removed in 153. |
| Fingerprint surface (UA, client hints, canvas, WebGL, screen) | You, per context | Unchanged between the versions; set with `newContext` options as before, or use [Camoufox](https://cdpfleet.com/docs/browsers/camoufox) when the identity itself must change. |

## Measured on the fleet (2026-10-04)

One headful launch of each on the production fleet through the same proxy, probed from inside a page and via tls.peet.ws. Timings are a single sample; core counts are the node's.

### Launch and cost

Single run; timings depend on the proxy and on fleet load.

|  | Chrome 154 | Chrome 153 |
| --- | --- | --- |
| Launch body | {"headless":false} | {"headless":false,"version":"153"} |
| Threads used | 2 (linux\_headful) | 2 (linux\_headful) |
| Browser version | 154.0.8037.97 | 153.0.8010.36 |
| Launch request → browser ready | 0.7 s | 1.3 s |
| Playwright connect | 0.0 s | 0.1 s |
| Load example.com | 0.5 s | 1.2 s |
| Load tls.peet.ws/api/all | 0.6 s | 3.2 s |

### What the network sees

From tls.peet.ws/api/all, requested by the browser itself. JA3 hashes change between runs of the same build (GREASE), so compare JA4 and the HTTP/2 fingerprint.

|  | Chrome 154 | Chrome 153 |
| --- | --- | --- |
| HTTP version | h2 | h2 |
| JA4 | t13d1517h2\_8daaf6152771\_cb7bf5808d99 | t13d1517h2\_8daaf6152771\_cb7bf5808d99 |
| Peetprint hash | fc97c1cdfb1409c9a9326c1b726d1dee | fc97c1cdfb1409c9a9326c1b726d1dee |
| Akamai HTTP/2 fingerprint | 1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p | 1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p |
| Cipher suites / extensions | 16 / 19 | 16 / 19 |
| Header order (first 12) | method, authority, scheme, path, sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-platform, upgrade-insecure-requests, user-agent, accept, sec-fetch-site, sec-fetch-mode | method, authority, scheme, path, sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-platform, upgrade-insecure-requests, user-agent, accept, sec-fetch-site, sec-fetch-mode |

### What page scripts see

Read with page.evaluate on example.com. Cores and memory are the server's and vary between fleet nodes.

|  | Chrome 154 | Chrome 153 |
| --- | --- | --- |
| navigator.userAgent | Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 | Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 |
| UA-CH brands | Chromium 154 · Google Chrome 154 · Not A(Brand 99 | Google Chrome 153 · Not\_A Brand 8 · Chromium 153 |
| UA-CH full version list | Chromium 154.0.8037.97 · Google Chrome 154.0.8037.97 · Not A(Brand 99.0.0.0 | Google Chrome 153.0.8010.36 · Not\_A Brand 8.0.0.0 · Chromium 153.0.8010.36 |
| navigator.platform / vendor | Linux x86\_64 / Google Inc. | Linux x86\_64 / Google Inc. |
| Languages | en-US, en | en-US, en |
| Timezone / locale | UTC / en-US | UTC / en-US |
| Screen (w×h×availW×availH×depth) | 1280x720x1280x720x24 | 1280x720x1280x720x24 |
| Window outer / inner / DPR | 1288x805 / 1280x720 / 1 | 1288x805 / 1280x720 / 1 |
| hardwareConcurrency / deviceMemory | 64 / 32 | 64 / 32 |
| WebGL vendor | Google Inc. (Google) | Google Inc. (Google) |
| WebGL renderer | ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver) | ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver) |
| WebGL version | WebGL 2.0 (OpenGL ES 3.0 Chromium) | WebGL 2.0 (OpenGL ES 3.0 Chromium) |
| WebGPU (navigator.gpu) | yes | yes |
| Canvas hash | f5a94624 | f5a94624 |
| navigator.webdriver | no | no |
| window.chrome / navigator.connection | yes / yes | yes / yes |
| Plugins / PDF viewer | 5 / yes | 5 / yes |
| Notification.permission / permissions.query | default / prompt | default / prompt |

### Web platform features

Presence probes; a user agent that claims one version while exposing another's features is a detectable inconsistency.

|  | Chrome 154 | Chrome 153 |
| --- | --- | --- |
| `Iterator.prototype.includes` (new in Chrome 154) | yes | no |
| `FontFace.width` (new in Chrome 154) | yes | no |
| CSS `text-decoration-inset` (Chrome 157) | no | no |
| `Iterator.prototype.join` (Chrome 153) | yes | yes |
| `Iterator.zip` (Chrome 153) | yes | yes |
| CSS `scroll-axis-lock` (Chrome 153) | no | no |
| `<camera>` element (Chrome 153) | yes | yes |
| `document.requestStorageAccessFor` (deprecated in 153) | no | yes |
| Topics API (`document.browsingTopics`) | yes | yes |
| Protected Audience (`navigator.joinAdInterestGroup`) | yes | yes |
| Shared Storage (`window.sharedStorage`) | no | no |
| Attribution Reporting (`window.attributionReporting`) | no | no |
| Private Aggregation | no | no |
| WebHID (`navigator.hid`) | yes | yes |

### bot.sannysoft.com

The classic headless-detection test page; what it marks red.

|  | Chrome 154 | Chrome 153 |
| --- | --- | --- |
| Checks / failed | 57 / 1 | 57 / 1 |
| Failed checks | WebGL Renderer | WebGL Renderer |

### A plain-HTTP URL (http://ip-api.com/json)

Chrome 154 warns before loading insecure HTTP by default — does that reach an automated session?

|  | Chrome 154 | Chrome 153 |
| --- | --- | --- |
| Final URL | http://ip-api.com/json/?fields=status | http://ip-api.com/json/?fields=status |
| HTTP status | 200 | 200 |
| Content loaded / warning page first | yes / no | yes / no |

### Playwright over the remote connection

Which client features work on this side.

|  | Chrome 154 | Chrome 153 |
| --- | --- | --- |
| page.evaluate runs in the page's own world | yes | yes |
| addInitScript visible to page scripts | yes | yes |
| Console events | yes | yes |
| Request interception (page.route) | yes | yes |
| Screenshot | yes | yes |
| PDF | yes | yes |
| Mobile device emulation | yes | yes |
| Tracing | yes | yes |

Rows where the two sides differ are highlighted. IP addresses are replaced with placeholders (203.0.113.x). The probe is `compare/probe.mjs` in our repository; the raw result is below.

Raw output

```
{
  "ran_at": "2026-10-04T21:08:09.390Z",
  "sides": [
    {
      "label": "Chrome 154",
      "engine": "chrome",
      "body": {
        "headless": false
      },
      "launch": {
        "browser": "chrome",
        "resource_class": "linux_headful",
        "weight": 2,
        "launch_ms": 653,
        "connect_ms": 32,
        "example_ms": 512,
        "peet_ms": 641
      },
      "network": {
        "http_version": "h2",
        "ja4": "t13d1517h2_8daaf6152771_cb7bf5808d99",
        "ja3_hash": "b3289d099f33354de20fb487a2d42241",
        "peetprint_hash": "fc97c1cdfb1409c9a9326c1b726d1dee",
        "ciphers": 16,
        "extensions": 19,
        "akamai_h2": "1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p",
        "akamai_h2_hash": "52d84b11737d980aef856699f885ca86",
        "header_order": [
          "method",
          "authority",
          "scheme",
          "path",
          "sec-ch-ua",
          "sec-ch-ua-mobile",
          "sec-ch-ua-platform",
          "upgrade-insecure-requests",
          "user-agent",
          "accept",
          "sec-fetch-site",
          "sec-fetch-mode"
        ]
      },
      "page": {
        "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36",
        "platform": "Linux x86_64",
        "vendor": "Google Inc.",
        "languages": [
          "en-US",
          "en"
        ],
        "hardware_concurrency": 64,
        "device_memory": 32,
        "max_touch_points": 0,
        "webdriver": false,
        "plugins": 5,
        "pdf_viewer": true,
        "ua_data": {
          "brands": [
            {
              "brand": "Chromium",
              "version": "154"
            },
            {
              "brand": "Google Chrome",
              "version": "154"
            },
            {
              "brand": "Not A(Brand",
              "version": "99"
            }
          ],
          "mobile": false,
          "platform": "Linux",
          "architecture": "x86",
          "bitness": "64",
          "formFactors": [
            "Desktop"
          ],
          "fullVersionList": [
            {
              "brand": "Chromium",
              "version": "154.0.8037.97"
            },
            {
              "brand": "Google Chrome",
              "version": "154.0.8037.97"
            },
            {
              "brand": "Not A(Brand",
              "version": "99.0.0.0"
            }
          ],
          "model": "",
          "platformVersion": "",
          "uaFullVersion": "154.0.8037.97",
          "wow64": false
        },
        "screen": "1280x720x1280x720x24",
        "window": {
          "outer": "1288x805",
          "inner": "1280x720",
          "dpr": 1
        },
        "timezone": "UTC",
        "locale": "en-US",
        "webgl": {
          "vendor": "Google Inc. (Google)",
          "renderer": "ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver)",
          "version": "WebGL 2.0 (OpenGL ES 3.0 Chromium)"
        },
        "canvas_hash": "f5a94624",
        "webgpu": true,
        "chrome_object": true,
        "chrome_runtime": false,
        "notification_permission": "default",
        "notification_query": "prompt",
        "has_focus": true,
        "connection_api": true,
        "stack_read_by_debugger": false,
        "features": {
          "iterator_includes": true,
          "iterator_join": true,
          "iterator_zip": true,
          "fontface_width": true,
          "css_text_decoration_inset": false,
          "css_scroll_axis_lock": false,
          "websocket_options_bag": null,
          "camera_element": true,
          "topics_api": true,
          "protected_audience": true,
          "shared_storage": false,
          "attribution_reporting": false,
          "request_storage_access_for": false,
          "webhid": true,
          "private_aggregation": false
        }
      },
      "page_main_world": null,
      "sannysoft": {
        "checks": 57,
        "failed": 1,
        "failed_names": [
          "WebGL Renderer"
        ],
        "passed": 30
      },
      "plain_http": {
        "final_url": "http://ip-api.com/json/?fields=status",
        "status": 200,
        "title": "",
        "loaded": true,
        "warning_page": false,
        "page_text": "{\"status\":\"success\"}"
      },
      "playwright": {
        "evaluate_in_main_world": true,
        "console_events": true,
        "init_script": true,
        "route": true,
        "screenshot": true,
        "pdf": true,
        "mobile_emulation": true,
        "tracing": true
      },
      "browser_version": "154.0.8037.97"
    },
    {
      "label": "Chrome 153",
      "engine": "chrome",
      "body": {
        "headless": false,
        "version": "153"
      },
      "launch": {
        "browser": "chrome",
        "resource_class": "linux_headful",
        "weight": 2,
        "launch_ms": 1302,
        "connect_ms": 126,
        "example_ms": 1201,
        "peet_ms": 3235
      },
      "network": {
        "http_version": "h2",
        "ja4": "t13d1517h2_8daaf6152771_cb7bf5808d99",
        "ja3_hash": "8c199af547de1666a4e3d7fade58dbb2",
        "peetprint_hash": "fc97c1cdfb1409c9a9326c1b726d1dee",
        "ciphers": 16,
        "extensions": 19,
        "akamai_h2": "1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p",
        "akamai_h2_hash": "52d84b11737d980aef856699f885ca86",
        "header_order": [
          "method",
          "authority",
          "scheme",
          "path",
          "sec-ch-ua",
          "sec-ch-ua-mobile",
          "sec-ch-ua-platform",
          "upgrade-insecure-requests",
          "user-agent",
          "accept",
          "sec-fetch-site",
          "sec-fetch-mode"
        ]
      },
      "page": {
        "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36",
        "platform": "Linux x86_64",
        "vendor": "Google Inc.",
        "languages": [
          "en-US",
          "en"
        ],
        "hardware_concurrency": 64,
        "device_memory": 32,
        "max_touch_points": 0,
        "webdriver": false,
        "plugins": 5,
        "pdf_viewer": true,
        "ua_data": {
          "brands": [
            {
              "brand": "Google Chrome",
              "version": "153"
            },
            {
              "brand": "Not_A Brand",
              "version": "8"
            },
            {
              "brand": "Chromium",
              "version": "153"
            }
          ],
          "mobile": false,
          "platform": "Linux",
          "architecture": "x86",
          "bitness": "64",
          "formFactors": [
            "Desktop"
          ],
          "fullVersionList": [
            {
              "brand": "Google Chrome",
              "version": "153.0.8010.36"
            },
            {
              "brand": "Not_A Brand",
              "version": "8.0.0.0"
            },
            {
              "brand": "Chromium",
              "version": "153.0.8010.36"
            }
          ],
          "model": "",
          "platformVersion": "",
          "uaFullVersion": "153.0.8010.36",
          "wow64": false
        },
        "screen": "1280x720x1280x720x24",
        "window": {
          "outer": "1288x805",
          "inner": "1280x720",
          "dpr": 1
        },
        "timezone": "UTC",
        "locale": "en-US",
        "webgl": {
          "vendor": "Google Inc. (Google)",
          "renderer": "ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver)",
          "version": "WebGL 2.0 (OpenGL ES 3.0 Chromium)"
        },
        "canvas_hash": "f5a94624",
        "webgpu": true,
        "chrome_object": true,
        "chrome_runtime": false,
        "notification_permission": "default",
        "notification_query": "prompt",
        "has_focus": true,
        "connection_api": true,
        "stack_read_by_debugger": false,
        "features": {
          "iterator_includes": false,
          "iterator_join": true,
          "iterator_zip": true,
          "fontface_width": false,
          "css_text_decoration_inset": false,
          "css_scroll_axis_lock": false,
          "websocket_options_bag": null,
          "camera_element": true,
          "topics_api": true,
          "protected_audience": true,
          "shared_storage": false,
          "attribution_reporting": false,
          "request_storage_access_for": true,
          "webhid": true,
          "private_aggregation": false
        }
      },
      "page_main_world": null,
      "sannysoft": {
        "checks": 57,
        "failed": 1,
        "failed_names": [
          "WebGL Renderer"
        ],
        "passed": 29
      },
      "plain_http": {
        "final_url": "http://ip-api.com/json/?fields=status",
        "status": 200,
        "title": "",
        "loaded": true,
        "warning_page": false,
        "page_text": "{\"status\":\"success\"}"
      },
      "playwright": {
        "evaluate_in_main_world": true,
        "console_events": true,
        "init_script": true,
        "route": true,
        "screenshot": true,
        "pdf": true,
        "mobile_emulation": true,
        "tracing": true
      },
      "browser_version": "153.0.8010.36"
    }
  ]
}
```

## Bottom line

For automation the headline change of 154 — the warning before plain `http://` pages — turns out not to reach fleet sessions: Playwright launches Chromium with HTTPS upgrades disabled, and we measured `http://` targets loading as before. What does change is that a version is now checkable from inside the page in at least three new ways (`Iterator.prototype.includes`, `FontFace.width`, the missing `requestStorageAccessFor`); the cheapest way to pass those checks is to run the version you claim.

Everything that an anti-bot system reads on the wire is identical between the two, so moving from 153 to 154 (or back, while 153 is pinned) does not change your TLS or HTTP/2 standing — only your JavaScript-level version story.

---
Source: https://cdpfleet.com/docs/compare/chrome-154-vs-153 · Markdown: https://cdpfleet.com/docs/compare/chrome-154-vs-153.md · All docs for AI tools: https://cdpfleet.com/llms.txt