[Updates](https://cdpfleet.com/docs/updates) / Google Chrome

# Chrome 157: HTTPS-First turned on (and off on cdpfleet), Protected Audience gone, same TLS fingerprint

Stable Chrome on the fleet is now 157.0.8103.38: HTTPS-First mode (kept off on cdpfleet), Protected Audience gone, TLS and HTTP/2 unchanged.

[Google Chrome](https://cdpfleet.com/docs/browsers/chrome) stable · 156.0.8078.79 → 157.0.8103.38 · 2026-11-06

Google promoted Chrome 157 to the stable channel on 2026-11-03 (213 security fixes, seven of them rated critical), and new `chrome` sessions on the fleet now run 157.0.8103.38 (the Linux build) instead of 156.0.8078.79. Pin the previous major with `"version"` if you need it.

## New

-   **CSS `text-decoration-inset`:** sets how far underlines, overlines and line-throughs are inset from, or extend beyond, the edges of the text (Chrome 157 release notes). Our feature probe finds it on 157 and not on 156.
-   **HTML streaming and positional methods:** `streamAppendHTML()` and its siblings return a `WritableStream` that parses HTML as text arrives, and positional methods (`before`, `after`, `append`, `prepend`, `replaceWith`) take HTML directly, superseding `insertAdjacentHTML` (release notes). Our probe finds `Element.prototype.streamAppendHTML` on 157 and not on 156.
-   **`WebTransport.reliability` and the canvas `srgb-linear` colour space:** both appear in our probe on 157 and not on 156, though neither is in the 157 release notes. Chrome Platform Status lists the WebTransport reliability attributes for 158 and the linear canvas colour spaces for 155.
-   Also in the release notes: a custom string for `text-overflow` (for example "(more)"), `position-visibility: anchor-valid` and the singular names `anchor-visible` / `anchor-valid` (the plural ones stay as aliases), HTML-in-canvas, an icon-only `displaymode` for the `<camera>`, `<microphone>` and `<geolocation>` capability elements, `ProgressEvent` in service workers, `BluetoothRemoteGATTServer` as an `EventTarget`, 64-bit atomic min/max on `atomic<vec2u>` in WebGPU, and `styleDuration` / `forcedStyleDuration` in Long Animation Frames. Origin trials: Connection Allowlists for embedded frames, and Overscroll Areas.
-   **CSS corner shorthands** (`corner`, `corner-top-left` and the rest) were listed as shipped in 157 when the release notes came out (Chrome Platform Status moved them to Chrome 160 on 2026-11-09), and our probe (`'corner' in document.documentElement.style`) doesn't find `corner` on 157.0.8103.38. Feature-test before you use them.

## Removed or changed

-   **Protected Audience is gone:** `navigator.joinAdInterestGroup` exists on 156 and not on 157. Chrome announced it would deprecate and remove the Protected Audience API after deciding to keep its current approach to third-party cookies (Chrome Platform Status); the 157 release notes don't list the removal. Our probes still find the Topics API (`document.browsingTopics`) and fenced frames on 157.
-   **Chrome 157 upgrades plain-HTTP URLs (HTTPS-First) — now off on cdpfleet:** our test navigates to `http://ip-api.com/json/?fields=status`, an API that answers over plain HTTP. On 156, measured the same week, it loaded over HTTP (status 200, `{"status":"success"}`), and a dev build of 157 from mid-October still did, so the change follows the browser version within the 157 cycle, not the server. On 157 the navigation ended at `https://ip-api.com/json/?fields=status`, and the page shows that server's HTTPS answer, a 403 with `{"status":"fail"}`, so our check counts it as not loaded. No warning page appeared. The 157 release notes don't mention it; our nodes team traced it on 2026-11-06 to Chrome's HTTPS-First balanced mode, which 157 turns on: an `http://` URL is upgraded when the site has HTTPS, and a site without HTTPS is blocked with `net::ERR_BLOCKED_BY_CLIENT` (httpforever.com and neverssl.com on the canary). Playwright's own switch (`--disable-features=HttpsUpgrades`) doesn't cover it. Since 2026-11-06 (09:34 UTC) every node turns it off by enterprise policy (`HttpsUpgradesEnabled: false`, `HttpsOnlyMode: "disallowed"`) for Chrome, Chromium, Brave and Edge, so `http://` stays `http://` on cdpfleet: re-measured on Chrome 157.0.8103.38 the same day, `http://ip-api.com/json/?fields=status` and `http://httpforever.com/` loaded over HTTP with status 200.
-   **Background Fetch enforces CORS:** Background Fetch requests now go through the same security checks as a regular `fetch()` (release notes).

## What sites see / detection

-   **User agent and client hints:** `Chrome/157.0.0.0` in the user agent, and the `Sec-CH-UA` brands change from `Not:A-Brand 8, Chromium 156, Google Chrome 156` to `Not-A.Brand 99, Google Chrome 157, Chromium 157`: a new placeholder brand, and Google Chrome now comes before Chromium. An allowlist that matches the exact brand string needs updating.
-   **TLS and HTTP/2 unchanged:** the JA4 hash, the peetprint hash, the HTTP/2 fingerprint, the header order and the cipher and extension counts are identical to 156.
-   **Page fingerprint unchanged:** WebGL, the canvas hash, plugins, the PDF viewer, languages, `navigator.webdriver`, `window.chrome` and the screen values read the same as on 156.
-   **Bot checks unchanged:** bot.sannysoft.com flagged one check (WebGL Renderer) before and after.

## For scraping

-   Launch options, the Playwright 1.60 client and `wsUrl` are the same, and every Playwright feature we test still works.
-   Plain-HTTP URLs need no change on cdpfleet: the HTTPS-First mode 157 turns on is switched off on every node. Your own Chrome 157 elsewhere will upgrade or block them unless the same policies are set.
-   If you match `Sec-CH-UA` brand strings or the full user agent somewhere (an allowlist, a test), update them to 157.

## Measured on the fleet

The same probe ran against 156.0.8078.79 and 157.0.8103.38 on the fleet, each when it went live: identity, TLS and HTTP/2 fingerprint, web platform features, Playwright features and bot checks. Host-dependent values (cores, memory, timings) are left out.

### What the site sees: identity

|  | Before | After |
| --- | --- | --- |
| User agent | Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36 | Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36 |
| Client hint brands | Not:A-Brand 8, Chromium 156, Google Chrome 156 | Not-A.Brand 99, Google Chrome 157, Chromium 157 |
| Client hint full versions | Not:A-Brand 8.0.0.0, Chromium 156.0.8078.79, Google Chrome 156.0.8078.79 | Not-A.Brand 99.0.0.0, Google Chrome 157.0.8103.38, Chromium 157.0.8103.38 |

### Web platform features added

-   CSS `text-decoration-inset` (Chrome 157)
-   `Element.streamAppendHTML` (Chrome 157)
-   `WebTransport.reliability` (on stable from Chrome 157; listed for 158)
-   Canvas `srgb-linear` colour space (on stable from Chrome 157)

### Web platform features removed

-   Protected Audience (`navigator.joinAdInterestGroup`)

### Plain HTTP pages

|  | Before | After |
| --- | --- | --- |
| Plain HTTP loaded | true | false |

Raw diff

```
{
  "engine": "chrome",
  "label": "stable",
  "from": "156.0.8078.79",
  "to": "157.0.8103.38",
  "browser_version": {
    "before": "156.0.8078.79",
    "after": "157.0.8103.38"
  },
  "changes": {
    "identity": [
      {
        "field": "user_agent",
        "before": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36",
        "after": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36"
      },
      {
        "field": "client_hint_brands",
        "before": "Not:A-Brand 8, Chromium 156, Google Chrome 156",
        "after": "Not-A.Brand 99, Google Chrome 157, Chromium 157"
      },
      {
        "field": "client_hint_full_versions",
        "before": "Not:A-Brand 8.0.0.0, Chromium 156.0.8078.79, Google Chrome 156.0.8078.79",
        "after": "Not-A.Brand 99.0.0.0, Google Chrome 157.0.8103.38, Chromium 157.0.8103.38"
      }
    ],
    "network": [],
    "features": {
      "added": [
        {
          "key": "css_text_decoration_inset",
          "label": "CSS `text-decoration-inset` (Chrome 157)"
        },
        {
          "key": "stream_append_html",
          "label": "`Element.streamAppendHTML` (Chrome 157)"
        },
        {
          "key": "webtransport_reliability",
          "label": "`WebTransport.reliability` (on stable from Chrome 157; listed for 158)"
        },
        {
          "key": "canvas_srgb_linear",
          "label": "Canvas `srgb-linear` colour space (on stable from Chrome 157)"
        }
      ],
      "removed": [
        {
          "key": "protected_audience",
          "label": "Protected Audience (`navigator.joinAdInterestGroup`)"
        }
      ]
    },
    "playwright": {
      "broke": [],
      "fixed": []
    },
    "fingerprint": [],
    "bot_checks": {
      "newly_failed": [],
      "newly_passed": [],
      "failed_before": 1,
      "failed_after": 1
    },
    "plain_http": [
      {
        "field": "plain_http_loaded",
        "before": true,
        "after": false
      }
    ],
    "launch": {
      "before_ms": 534,
      "after_ms": 497
    }
  },
  "host_dependent_ignored": [
    "hardware_concurrency",
    "device_memory",
    "launch/connect/page timings"
  ]
}
```

### Sources

-   [Chrome Releases: Stable Channel Update for Desktop (2026-11-03)](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
-   [Chrome 157 release notes (Chrome Platform Status)](https://chromestatus.com/release-notes/157)
-   [Deprecate and Remove Protected Audience (Chrome Platform Status)](https://chromestatus.com/feature/6552486106234880)
-   [WebTransport reliability attributes (Chrome Platform Status)](https://chromestatus.com/feature/5094058497277952)
-   [PredefinedColorSpace srgb-linear and display-p3-linear (Chrome Platform Status)](https://chromestatus.com/feature/5122501071994880)

---
Source: https://cdpfleet.com/docs/updates/chrome-157 · Markdown: https://cdpfleet.com/docs/updates/chrome-157.md · All docs for AI tools: https://cdpfleet.com/llms.txt