Leaking Chromium/Brave full version through navigator.userAgentData.getHighEntropyValues()

[ShivanKaul]

Description

This is what I get in dev console or by going to https://browserleaks.com/client-hints (scroll down for the JS API):

> await navigator.userAgentData.getHighEntropyValues(["fullVersionList", "uaFullVersion"]);

We should not leak the full version in fullVersionList and uaFullVersion and instead clamp it to the major version, same as in brands (108 in this case).

There's a separate webcompat question of what to do about high entropy values for "platformVersion, "architecture", "platform", "bitness" but for UA versions it's clear that we should just match what we have in the UA.

[kjozwiak]

The above requires 1.46.139 or higher for 1.46.x verification 👍

[stephendonner]

Verified PASSED using

Brave	1.46.141 Chromium: 108.0.5359.99 (Official Build) (x86_64)
Revision	410951fc34bb4b2cbf182231f9f779efaafaf682-refs/branch-heads/5359_71@{#9}
OS	macOS Version 13.1 (Build 22C65)

Steps:

1. installed 1.46.141
2. launched Brave
3. opened Developer Tools
4. clicked on the Console tab
5. entered await navigator.userAgentData.getHighEntropyValues(["fullVersionList", "uaFullVersion"]);
6. expanded the fullVersionList

Confirmed we only show the first digit of the version

---

Verification PASSED on

Brave | 1.46.141 Chromium: 108.0.5359.99 (Official Build) (64-bit)
-- | --
Revision | 410951fc34bb4b2cbf182231f9f779efaafaf682-refs/branch-heads/5359_71@{#9}
OS | Windows 10 Version 21H2 (Build 19044.2251)

Steps:

1. installed 1.46.141
2. launched Brave and open https://browserleaks.com/client-hints
3. opened Developer Tools
4. clicked on the Console tab
5. entered await navigator.userAgentData.getHighEntropyValues(["fullVersionList", "uaFullVersion"]);
6. expanded the fullVersionList
   

[btlechowski]

Verification PASSED on

Brave	1.46.141 Chromium: 108.0.5359.99 (Official Build) (64-bit)
Revision	410951fc34bb4b2cbf182231f9f779efaafaf682-refs/branch-heads/5359_71@{#9}
OS	Ubuntu 18.04 LTS

Steps:

1. installed 1.46.141
2. launched Brave
3. opened Developer Tools
4. clicked on the Console tab
5. entered await navigator.userAgentData.getHighEntropyValues(["fullVersionList", "uaFullVersion"]);
6. expanded the fullVersionList

Confirmed we only show the first digit of the version

[Uni-verse]

Verified on Samsung Galaxy S21 & Samsung Galaxy Tab S7 using the following build version(s):

Brave	1.46.141 Chromium: 108.0.5359.99 (Official Build) (64-bit) 
Revision	410951fc34bb4b2cbf182231f9f779efaafaf682-refs/branch-heads/5359_71@{#9}
OS	Android 12; Build/SP1A.210812.016

Acceptance Criteria:

• We should not leak the full version in fullVersionList and uaFullVersion and instead clamp it to the major version, same as in brands (108 in this case).

Test Steps:

1. installed 1.46.141
2. launched Brave and open https://browserleaks.com/client-hints
3. opened Developer Tools
4. clicked on the Console tab
5. entered await navigator.userAgentData.getHighEntropyValues(["fullVersionList", "uaFullVersion"]); in the console
6. expanded the fullVersionList

• Verified we are only showing the major version in FullVersion object and brands list.