A brand new report dubbed “BrowserGate” warns that Microsoft’s LinkedIn is utilizing hidden JavaScript scripts on its web site to scan guests’ browsers for put in extensions and gather gadget knowledge.
Based on a report by Fairlinked e.V., which claims to be an affiliation of business LinkedIn customers, Microsoft’s platform injects JavaScript into person periods that checks for 1000’s of browser extensions and hyperlinks the outcomes to identifiable person profiles.
The writer claims that this conduct is used to gather delicate private and company data, as LinkedIn accounts are tied to actual identities, employers, and job roles.
“LinkedIn scans for over 200 merchandise that straight compete with its personal gross sales instruments, together with Apollo, Lusha, and ZoomInfo. As a result of LinkedIn is aware of every person’s employer, it may map which firms use which competitor merchandise. It’s extracting the shopper lists of 1000’s of software program firms from their customers’ browsers with out anybody’s information,’ the report says.
“Then it uses what it finds. LinkedIn has already sent enforcement threats to users of third-party tools, using data obtained through this covert scanning to identify its targets.”
BleepingComputer has independently confirmed a part of these claims by our personal testing, throughout which we noticed a JavaScript file with a randomized filename being loaded by LinkedIn’s web site.
This script checked for six,236 browser extensions by trying to entry file sources related to a selected extension ID, a identified method for detecting whether or not extensions are put in.
This fingerprinting script was beforehand reported in 2025, but it surely was solely detecting roughly 2,000 extensions at the moment. A unique GitHub repository from two months in the past reveals 3,000 extensions being detected, demonstrating that the variety of detected extensions continues to develop.
Supply: BleepingComputer
Whereas lots of the extensions which are scanned for are associated to LinkedIn, the script additionally surprisingly detected language and grammar extensions, instruments for tax professionals, and different seemingly unrelated options.
The script additionally collects a variety of browser and gadget knowledge, together with CPU core rely, out there reminiscence, display screen decision, timezone, language settings, battery standing, audio data, and storage options.
Supply: BleepingComputer
BleepingComputer couldn’t confirm the claims within the BrowserGate report about the usage of the info or whether or not it’s shared with third-party firms.
Nevertheless, related fingerprinting methods have been used prior to now to construct distinctive browser profiles, which might allow monitoring customers throughout web sites.
LinkedIn denies knowledge use allegations
LinkedIn doesn’t dispute that it detects particular browser extensions, telling BleepingComputer that the information is used to guard the platform and its customers.
Nevertheless, the corporate claims the report is from somebody whose account was banned for scraping LinkedIn content material and violating the positioning’s phrases of use.
“The claims made on the web site linked listed below are plain flawed. The particular person behind them is topic to an account restriction for scraping and different violations of LinkedIn’s Phrases of Service.
To guard the privateness of our members, their knowledge, and to make sure web site stability, we do search for extensions that scrape knowledge with out members’ consent or in any other case violate LinkedIn’s Phrases of Service.
Right here’s why: some extensions have static sources (pictures, javascript) out there to inject into our webpages. We are able to detect the presence of those extensions by checking if that static useful resource URL exists. This detection is seen contained in the Chrome developer console. We use this knowledge to find out which extensions violate our phrases, to tell and enhance our technical defenses, and to grasp why a member account may be fetching an inordinate quantity of different members’ knowledge, which at scale, impacts web site stability. We don’t use this knowledge to deduce delicate details about members.
For extra context, in retaliation for this web site proprietor’s account restriction, they tried to acquire an injunction in Germany, alleging LinkedIn had violated varied legal guidelines. The courtroom dominated towards them and located their claims towards LinkedIn had no advantage, and in reality, this particular person’s personal knowledge practices ran afoul of the regulation.
Sadly, this can be a case of a person who misplaced within the courtroom of regulation, however is in search of to re-litigate within the courtroom of public opinion with out regard for accuracy.”
LinkedIn claims the BrowserGate report stems from a dispute involving the developer of a LinkedIn-related browser extension known as “Teamfluence,” which LinkedIn says it restricted for violating the platform’s phrases.
In paperwork shared with BleepingComputer, a German courtroom denied the developer’s request for a preliminary injunction, discovering that LinkedIn’s actions didn’t represent illegal obstruction or discrimination.
The courtroom additionally discovered that automated knowledge assortment alone may infringe upon LinkedIn’s phrases of use and that it was entitled to dam the accounts to guard its platform.
LinkedIn argues the BrowserGate report is an try and re-litigate that dispute publicly.
Whatever the causes for the report, one level is undisputed.
LinkedIn’s web site makes use of a fingerprinting script that detects over 6,000 extensions working in a Chromium browser, together with different knowledge a couple of customer’s system.
This isn’t the primary time that firms have used aggressive fingerprinting scripts to detect applications working on a customer’s gadget.
In 2021, eBay was discovered to make use of JavaScript to carry out automated port scans on guests’ units to find out whether or not they have been working varied distant assist software program.
Whereas eBay by no means confirmed why they have been utilizing these scripts, it was extensively believed that they have been used to dam fraud on compromised units.
It was later found that quite a few different firms have been utilizing the identical fingerprinting script, together with Citibank, TD Financial institution, Ameriprise, Chick-fil-A, Lendup, BeachBody, Equifax IQ join, TIAA-CREF, Sky, GumTree, and WePay.
Automated pentesting proves the trail exists. BAS proves whether or not your controls cease it. Most groups run one with out the opposite.
This whitepaper maps six validation surfaces, reveals the place protection ends, and supplies practitioners with three diagnostic questions for any device analysis.
