Look up browser vulnerabilities by User-Agent

Quick start

No API key. CORS is open. A frontend fetch from your site sends the visitor User-Agent header automatically.

const res = await fetch("https://ismybrowsersafe.org/api/v1/lookup");
const data = await res.json();

if (data.ok) {
  console.log(data.browser.name, data.browser.version);
  console.log(data.count); // known vulnerabilities
}

Endpoint

How the User-Agent is chosen

1. Request header

   If you call the API from the visitor’s browser with fetch/XHR and omit ua, the browser sends its User-Agent. source is "header".

2. Query parameter

   Pass ua, userAgent or user_agent to inspect any string, including navigator.userAgent. source is "query".

3. JSON body

   POST {"userAgent":"..."} or {"ua":"..."}. Useful on the server. source is "body".

Priority: JSON body > query parameter > User-Agent header.

Parameters

Response

Successful responses always include ok: true and count. count is the number of publicly disclosed CVEs still matching the detected version.

{
  "ok": true,
  "source": "header",
  "browser": { "id": "chrome", "name": "Google Chrome", "version": "122.0.6261.94" },
  "engine": { "id": "chromium", "name": "Chromium", "version": "122.0.6261.94" },
  "os": "windows",
  "architecture": "x86_64",
  "status": "high",
  "riskScore": 72,
  "confidence": "high",
  "estimated": false,
  "majorVersionsBehind": 23,
  "count": 150,
  "vulnerabilities": { "total": 150, "critical": 3, "high": 37, "medium": 92, "low": 18 },
  "knownExploited": 2,
  "securityFixesSinceVersion": 327,
  "recommendation": {
    "action": "update",
    "message": "Update Google Chrome to the latest version. Latest stable: 145.0.0.0.",
    "messageKey": "recommend.update_chrome"
  }
}

Errors

{ "ok": false, "error": "unrecognized user-agent" }

400 if the User-Agent is missing, too long, or unrecognized. 500 if lookup fails internally.

Examples

Frontend: current visitor

Use this on your website. The visitor User-Agent is sent by the browser. No extra headers required, so there is no CORS preflight.

async function checkVisitor() {
  const res = await fetch("https://ismybrowsersafe.org/api/v1/lookup");
  const data = await res.json();
  if (!data.ok) throw new Error(data.error);
  return data.count;
}

Frontend: pass navigator.userAgent

Equivalent to the header, but explicit. Useful if you already captured the string.

const ua = encodeURIComponent(navigator.userAgent);
const res = await fetch(
  "https://ismybrowsersafe.org/api/v1/lookup?ua=" + ua
);
const data = await res.json();
document.getElementById("risk").textContent =
  data.browser.name + " · " + data.count + " CVEs";

Include CVE details

const res = await fetch(
  "https://ismybrowsersafe.org/api/v1/lookup?details=1&limit=5"
);
const data = await res.json();
for (const item of data.items || []) {
  console.log(item.cve, item.severity, item.title);
}

curl: inspect any User-Agent

curl -G https://ismybrowsersafe.org/api/v1/lookup \
  --data-urlencode "ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36"

curl -X POST https://ismybrowsersafe.org/api/v1/lookup \
  -H "Content-Type: application/json" \
  -d "{\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0\",\"details\":true,\"limit\":3}"

HTML widget

Drop this onto any page to show how many known issues match the visitor’s browser.

<div id="browsershield">Checking browser…</div>
<script>
(async () => {
  const el = document.getElementById("browsershield");
  try {
    const res = await fetch("https://ismybrowsersafe.org/api/v1/lookup");
    const data = await res.json();
    if (!data.ok) throw new Error(data.error);
    el.textContent = data.browser.name + " " + data.browser.version +
      " · " + data.count + " known vulnerabilities";
  } catch (err) {
    el.textContent = "Browser check unavailable";
  }
})();
</script>

Try it

{ }

Notes

CORS

GET from the browser is a simple request. POST with JSON sends a preflight OPTIONS request; the API answers it.

Frozen User-Agent

Chrome may freeze the patch version in User-Agent. estimated will be true and matching uses the available version. This API does not read Client Hints from third-party sites.

Privacy

The User-Agent is not stored. Usage stats are aggregated by browser, major version, engine and OS per day.

What this is not

BrowserShield never exploits vulnerabilities. Results come from public CVE and vendor advisory data.

Check my browser