"RV" in Firefox user agent strings
I have noticed some activity in my server logs featuring user agent strings where the "rv" component contains a decimal number greater than 0, such as the following example:
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.8) Gecko/20100101 Firefox/124.0
Could you please clarify if there are instances where the "rv" portion of a user agent string would legitimately include a decimal number greater than 0?
This looks to be something suspicious going on and would like to make sure if this is something legitimate or not.
All Replies (2)
The rv is the Gecko version and should be the same as the Firefox version. That UA is incorrect with the rv: and Firefox version as it may have been manually modified in useragent Preference.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent/Firefox
The Firefox UA's have gotten more generic over the years for users to have less of a fingerprint like for example it used to show the build date in the UA of when that Firefox was built, whether it be a Release or a development channel build. The minor Firefox updates has not been shown in UA since Fx 16.0.1 if I recall. For example the UA for Firefox 130.0.1 shows as 130.0
For Windows it has shown as NT 10.0 only since Fx 116.0 even though Windows 11 users would show NT 10.0 anyways (based on same NT 10.0 kernel) and because Windows 7, 8, 8.1 users cannot run Fx 116 or later. For macOS users since Fx 116.0 and later it shows as macOS 10.15 in the UA even if they are using Firefox on a later version of macOS.
Modified by James
Note that Firefox never had rv:11x in the user agent, for Firefox 110 until 119, the rv value was frozen to rv:109.0.
See:
You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.