Avast Secure Browser emits an inconsistent User-Agent depending on request context. Document/navigation requests and service-worker-initiated fetch requests carry different UA strings - one includes the Avast/x.x.x token, the other omits it. On sites behind Cloudflare, this breaks the site: Cloudflare binds its cf_clearance clearance cookie to the exact User-Agent that solved the challenge, so when a later request arrives with the other UA, the cookie is treated as invalid and the user is re-challenged endlessly.
This appears to be the same behaviour reported in another thread: https[:]//community.avast.com/t/cloudflare-problem/903285/4
Steps to reproduce:
-
Visit a Cloudflare-protected site that registers a service worker and is configured to issue a Managed Challenge.
-
Solve the challenge on first load - challenge reappears and loops indefinitely.
Observed UA mismatch (same browser, same session):
-
Document context:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Avast/148.0.0.0 -
Service-worker fetch:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Expected: The User-Agent should be identical across all request contexts (document, subresource, XHR/fetch, and service-worker fetch), as it is in Chrome. Chrome does not loop because its UA is consistent.