Updates / Google Chrome

Chrome 157: HTTPS-First turned on (and off on cdpfleet), Protected Audience gone, same TLS fingerprint

Stable Chrome on the fleet is now 157.0.8103.38: HTTPS-First mode (kept off on cdpfleet), Protected Audience gone, TLS and HTTP/2 unchanged.

Google Chrome stable · 156.0.8078.79 → 157.0.8103.38 · 2026-11-06

Google promoted Chrome 157 to the stable channel on 2026-11-03 (213 security fixes, seven of them rated critical), and new chrome sessions on the fleet now run 157.0.8103.38 (the Linux build) instead of 156.0.8078.79. Pin the previous major with "version" if you need it.

New

CSS text-decoration-inset: sets how far underlines, overlines and line-throughs are inset from, or extend beyond, the edges of the text (Chrome 157 release notes). Our feature probe finds it on 157 and not on 156.
HTML streaming and positional methods: streamAppendHTML() and its siblings return a WritableStream that parses HTML as text arrives, and positional methods (before, after, append, prepend, replaceWith) take HTML directly, superseding insertAdjacentHTML (release notes). Our probe finds Element.prototype.streamAppendHTML on 157 and not on 156.
WebTransport.reliability and the canvas srgb-linear colour space: both appear in our probe on 157 and not on 156, though neither is in the 157 release notes. Chrome Platform Status lists the WebTransport reliability attributes for 158 and the linear canvas colour spaces for 155.
Also in the release notes: a custom string for text-overflow (for example "(more)"), position-visibility: anchor-valid and the singular names anchor-visible / anchor-valid (the plural ones stay as aliases), HTML-in-canvas, an icon-only displaymode for the <camera>, <microphone> and <geolocation> capability elements, ProgressEvent in service workers, BluetoothRemoteGATTServer as an EventTarget, 64-bit atomic min/max on atomic<vec2u> in WebGPU, and styleDuration / forcedStyleDuration in Long Animation Frames. Origin trials: Connection Allowlists for embedded frames, and Overscroll Areas.
CSS corner shorthands (corner, corner-top-left and the rest) were listed as shipped in 157 when the release notes came out (Chrome Platform Status moved them to Chrome 160 on 2026-11-09), and our probe ('corner' in document.documentElement.style) doesn't find corner on 157.0.8103.38. Feature-test before you use them.

Removed or changed

Protected Audience is gone: navigator.joinAdInterestGroup exists on 156 and not on 157. Chrome announced it would deprecate and remove the Protected Audience API after deciding to keep its current approach to third-party cookies (Chrome Platform Status); the 157 release notes don't list the removal. Our probes still find the Topics API (document.browsingTopics) and fenced frames on 157.
Chrome 157 upgrades plain-HTTP URLs (HTTPS-First) — now off on cdpfleet: our test navigates to http://ip-api.com/json/?fields=status, an API that answers over plain HTTP. On 156, measured the same week, it loaded over HTTP (status 200, {"status":"success"}), and a dev build of 157 from mid-October still did, so the change follows the browser version within the 157 cycle, not the server. On 157 the navigation ended at https://ip-api.com/json/?fields=status, and the page shows that server's HTTPS answer, a 403 with {"status":"fail"}, so our check counts it as not loaded. No warning page appeared. The 157 release notes don't mention it; our nodes team traced it on 2026-11-06 to Chrome's HTTPS-First balanced mode, which 157 turns on: an http:// URL is upgraded when the site has HTTPS, and a site without HTTPS is blocked with net::ERR_BLOCKED_BY_CLIENT (httpforever.com and neverssl.com on the canary). Playwright's own switch (--disable-features=HttpsUpgrades) doesn't cover it. Since 2026-11-06 (09:34 UTC) every node turns it off by enterprise policy (HttpsUpgradesEnabled: false, HttpsOnlyMode: "disallowed") for Chrome, Chromium, Brave and Edge, so http:// stays http:// on cdpfleet: re-measured on Chrome 157.0.8103.38 the same day, http://ip-api.com/json/?fields=status and http://httpforever.com/ loaded over HTTP with status 200.
Background Fetch enforces CORS: Background Fetch requests now go through the same security checks as a regular fetch() (release notes).

What sites see / detection

User agent and client hints: Chrome/157.0.0.0 in the user agent, and the Sec-CH-UA brands change from Not:A-Brand 8, Chromium 156, Google Chrome 156 to Not-A.Brand 99, Google Chrome 157, Chromium 157: a new placeholder brand, and Google Chrome now comes before Chromium. An allowlist that matches the exact brand string needs updating.
TLS and HTTP/2 unchanged: the JA4 hash, the peetprint hash, the HTTP/2 fingerprint, the header order and the cipher and extension counts are identical to 156.
Page fingerprint unchanged: WebGL, the canvas hash, plugins, the PDF viewer, languages, navigator.webdriver, window.chrome and the screen values read the same as on 156.
Bot checks unchanged: bot.sannysoft.com flagged one check (WebGL Renderer) before and after.

For scraping

Launch options, the Playwright 1.60 client and wsUrl are the same, and every Playwright feature we test still works.
Plain-HTTP URLs need no change on cdpfleet: the HTTPS-First mode 157 turns on is switched off on every node. Your own Chrome 157 elsewhere will upgrade or block them unless the same policies are set.
If you match Sec-CH-UA brand strings or the full user agent somewhere (an allowlist, a test), update them to 157.

Measured on the fleet

The same probe ran against 156.0.8078.79 and 157.0.8103.38 on the fleet, each when it went live: identity, TLS and HTTP/2 fingerprint, web platform features, Playwright features and bot checks. Host-dependent values (cores, memory, timings) are left out.

What the site sees: identity

	Before	After
User agent	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36
Client hint brands	Not:A-Brand 8, Chromium 156, Google Chrome 156	Not-A.Brand 99, Google Chrome 157, Chromium 157
Client hint full versions	Not:A-Brand 8.0.0.0, Chromium 156.0.8078.79, Google Chrome 156.0.8078.79	Not-A.Brand 99.0.0.0, Google Chrome 157.0.8103.38, Chromium 157.0.8103.38

Web platform features added

CSS text-decoration-inset (Chrome 157)
Element.streamAppendHTML (Chrome 157)
WebTransport.reliability (on stable from Chrome 157; listed for 158)
Canvas srgb-linear colour space (on stable from Chrome 157)

Web platform features removed

Protected Audience (navigator.joinAdInterestGroup)

Plain HTTP pages

	Before	After
Plain HTTP loaded	true	false

Raw diff

{
  "engine": "chrome",
  "label": "stable",
  "from": "156.0.8078.79",
  "to": "157.0.8103.38",
  "browser_version": {
    "before": "156.0.8078.79",
    "after": "157.0.8103.38"
  },
  "changes": {
    "identity": [
      {
        "field": "user_agent",
        "before": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36",
        "after": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36"
      },
      {
        "field": "client_hint_brands",
        "before": "Not:A-Brand 8, Chromium 156, Google Chrome 156",
        "after": "Not-A.Brand 99, Google Chrome 157, Chromium 157"
      },
      {
        "field": "client_hint_full_versions",
        "before": "Not:A-Brand 8.0.0.0, Chromium 156.0.8078.79, Google Chrome 156.0.8078.79",
        "after": "Not-A.Brand 99.0.0.0, Google Chrome 157.0.8103.38, Chromium 157.0.8103.38"
      }
    ],
    "network": [],
    "features": {
      "added": [
        {
          "key": "css_text_decoration_inset",
          "label": "CSS `text-decoration-inset` (Chrome 157)"
        },
        {
          "key": "stream_append_html",
          "label": "`Element.streamAppendHTML` (Chrome 157)"
        },
        {
          "key": "webtransport_reliability",
          "label": "`WebTransport.reliability` (on stable from Chrome 157; listed for 158)"
        },
        {
          "key": "canvas_srgb_linear",
          "label": "Canvas `srgb-linear` colour space (on stable from Chrome 157)"
        }
      ],
      "removed": [
        {
          "key": "protected_audience",
          "label": "Protected Audience (`navigator.joinAdInterestGroup`)"
        }
      ]
    },
    "playwright": {
      "broke": [],
      "fixed": []
    },
    "fingerprint": [],
    "bot_checks": {
      "newly_failed": [],
      "newly_passed": [],
      "failed_before": 1,
      "failed_after": 1
    },
    "plain_http": [
      {
        "field": "plain_http_loaded",
        "before": true,
        "after": false
      }
    ],
    "launch": {
      "before_ms": 534,
      "after_ms": 497
    }
  },
  "host_dependent_ignored": [
    "hardware_concurrency",
    "device_memory",
    "launch/connect/page timings"
  ]
}