A brand new report dubbed “BrowserGate” warns that Microsoft’s LinkedIn is utilizing hidden JavaScript scripts on its web site to scan guests’ browsers for put in extensions and acquire machine information.
In response to a report by Fairlinked e.V., which claims to be an affiliation of business LinkedIn customers, Microsoft’s platform injects JavaScript into person classes that checks for hundreds of browser extensions and hyperlinks the outcomes to identifiable person profiles.
The creator claims that this habits is used to gather delicate private and company data, as LinkedIn accounts are tied to actual identities, employers, and job roles.
“LinkedIn scans for over 200 merchandise that instantly compete with its personal gross sales instruments, together with Apollo, Lusha, and ZoomInfo. As a result of LinkedIn is aware of every person’s employer, it will possibly map which firms use which competitor merchandise. It’s extracting the shopper lists of hundreds of software program firms from their customers’ browsers with out anybody’s information,’ the report says.
“Then it uses what it finds. LinkedIn has already sent enforcement threats to users of third-party tools, using data obtained through this covert scanning to identify its targets.”
BleepingComputer has independently confirmed a part of these claims via our personal testing, throughout which we noticed a JavaScript file with a randomized filename being loaded by LinkedIn’s web site.
This script checked for six,236 browser extensions by making an attempt to entry file sources related to a selected extension ID, a identified approach for detecting whether or not extensions are put in.
This fingerprinting script was beforehand reported in 2025, but it surely was solely detecting roughly 2,000 extensions at the moment. A distinct GitHub repository from two months in the past reveals 3,000 extensions being detected, demonstrating that the variety of detected extensions continues to develop.
Supply: BleepingComputer
Whereas most of the extensions which might be scanned for are associated to LinkedIn, the script additionally surprisingly detected language and grammar extensions, instruments for tax professionals, and different seemingly unrelated options.
The script additionally collects a variety of browser and machine information, together with CPU core rely, accessible reminiscence, display screen decision, timezone, language settings, battery standing, audio data, and storage options.
Supply: BleepingComputer
BleepingComputer couldn’t confirm the claims within the BrowserGate report about the usage of the info or whether or not it’s shared with third-party firms.
Nonetheless, related fingerprinting methods have been used up to now to construct distinctive browser profiles, which might allow monitoring customers throughout web sites.
LinkedIn denies information use allegations
LinkedIn doesn’t dispute that it detects particular browser extensions, telling BleepingComputer that the data is used to guard the platform and its customers.
Nonetheless, the corporate claims the report is from somebody whose account was banned for scraping LinkedIn content material and violating the location’s phrases of use.
“The claims made on the web site linked listed here are plain fallacious. The individual behind them is topic to an account restriction for scraping and different violations of LinkedIn’s Phrases of Service.
To guard the privateness of our members, their information, and to make sure website stability, we do search for extensions that scrape information with out members’ consent or in any other case violate LinkedIn’s Phrases of Service.
Right here’s why: some extensions have static sources (pictures, javascript) accessible to inject into our webpages. We will detect the presence of those extensions by checking if that static useful resource URL exists. This detection is seen contained in the Chrome developer console. We use this information to find out which extensions violate our phrases, to tell and enhance our technical defenses, and to know why a member account is likely to be fetching an inordinate quantity of different members’ information, which at scale, impacts website stability. We don’t use this information to deduce delicate details about members.
For extra context, in retaliation for this web site proprietor’s account restriction, they tried to acquire an injunction in Germany, alleging LinkedIn had violated varied legal guidelines. The court docket dominated in opposition to them and located their claims in opposition to LinkedIn had no benefit, and actually, this particular person’s personal information practices ran afoul of the regulation.
Sadly, this can be a case of a person who misplaced within the court docket of regulation, however is searching for to re-litigate within the court docket of public opinion with out regard for accuracy.”
LinkedIn claims the BrowserGate report stems from a dispute involving the developer of a LinkedIn-related browser extension known as “Teamfluence,” which LinkedIn says it restricted for violating the platform’s phrases.
In paperwork shared with BleepingComputer, a German court docket denied the developer’s request for a preliminary injunction, discovering that LinkedIn’s actions didn’t represent illegal obstruction or discrimination.
The court docket additionally discovered that automated information assortment alone might infringe upon LinkedIn’s phrases of use and that it was entitled to dam the accounts to guard its platform.
LinkedIn argues the BrowserGate report is an try to re-litigate that dispute publicly.
Whatever the causes for the report, one level is undisputed.
LinkedIn’s website makes use of a fingerprinting script that detects over 6,000 extensions operating in a Chromium browser, together with different information a few customer’s system.
This isn’t the primary time that firms have used aggressive fingerprinting scripts to detect applications operating on a customer’s machine.
In 2021, eBay was discovered to make use of JavaScript to carry out automated port scans on guests’ gadgets to find out whether or not they have been operating varied distant assist software program.
Whereas eBay by no means confirmed why they have been utilizing these scripts, it was broadly believed that they have been used to dam fraud on compromised gadgets.
It was later found that quite a few different firms have been utilizing the identical fingerprinting script, together with Citibank, TD Financial institution, Ameriprise, Chick-fil-A, Lendup, BeachBody, Equifax IQ join, TIAA-CREF, Sky, GumTree, and WePay.
Automated pentesting proves the trail exists. BAS proves whether or not your controls cease it. Most groups run one with out the opposite.
This whitepaper maps six validation surfaces, reveals the place protection ends, and gives practitioners with three diagnostic questions for any instrument analysis.
