LinkedIn Script Scans for 6,236 Browser Extensions and Collects Device Data
Summary
BleepingComputer confirmed LinkedIn loads a script that checks for 6,236 browser extensions and gathers device and browser data. Fairlinked alleges the data is used to profile users; LinkedIn says detection supports anti-scraping defenses and denies sensitive inference.
Key points
- BleepingComputer observed a LinkedIn JavaScript file with a randomized name that checked for 6,236 browser extensions.
- The script gathers device and browser details, including CPU cores, memory, screen resolution, timezone, language settings, and battery status.
- Fairlinked’s BrowserGate report alleges LinkedIn links extension detections to user profiles and uses them to identify users of competing tools; BleepingComputer could not verify those data-use claims.
- LinkedIn says it detects extensions that scrape data or violate its terms to protect members, improve defenses, and maintain site stability. It denies using the data to infer sensitive information.
- LinkedIn says the report’s author had an account restricted for scraping. A German court denied the author’s request for a preliminary injunction in the related dispute.
Article Details
- Event Type
- Security and privacy investigation into LinkedIn’s browser-extension detection and device fingerprinting, following Fairlinked e.V.’s BrowserGate allegations and BleepingComputer’s independent testing.
- Impact
- BleepingComputer observed LinkedIn load a script that checked for 6,236 browser extensions and collected browser and device attributes, including CPU cores, memory, screen resolution, timezone, language, and battery status. Fairlinked alleges the data is linked to identifiable profiles and used to identify users of competing products; BleepingComputer could not verify those data-use claims. LinkedIn says it uses extension detection to enforce its terms, protect users, and maintain site stability, and denies using the data to infer sensitive information. A German court denied the extension developer’s request for a preliminary injunction in the related dispute.
Vendors
LinkedInA new report called “BrowserGate” alleges Microsoft-owned LinkedIn injects hidden JavaScript into user sessions to scan for installed browser extensions and collect detailed device fingerprinting data.MicrosoftA new report called “BrowserGate” alleges Microsoft-owned LinkedIn injects hidden JavaScript into user sessions to scan for installed browser extensions and collect detailed device fingerprinting data.
Products
Google ChromeThis detection is visible inside the Chrome developer console.LinkedInA new report called “BrowserGate” alleges Microsoft-owned LinkedIn injects hidden JavaScript into user sessions to scan for installed browser extensions and collect detailed device fingerprinting data.TeamfluenceLinkedIn claims the BrowserGate report stems from a dispute involving the developer of a LinkedIn-related browser extension called “Teamfluence,” which LinkedIn says it restricted for violating the platform’s terms.