A brand new report dubbed “BrowserGate” warns that Microsoft’s LinkedIn is utilizing hidden JavaScript scripts on its web site to scan guests’ browsers for put in extensions and acquire machine information.
In keeping with a report by Fairlinked e.V., which claims to be an affiliation of economic LinkedIn customers, Microsoft’s platform injects JavaScript into consumer classes that checks for hundreds of browser extensions and hyperlinks the outcomes to identifiable consumer profiles.
The writer claims that this habits is used to gather delicate private and company info, as LinkedIn accounts are tied to actual identities, employers, and job roles.
“LinkedIn scans for over 200 merchandise that immediately compete with its personal gross sales instruments, together with Apollo, Lusha, and ZoomInfo. As a result of LinkedIn is aware of every consumer’s employer, it may map which corporations use which competitor merchandise. It’s extracting the shopper lists of hundreds of software program corporations from their customers’ browsers with out anybody’s information,’ the report says.
“Then it makes use of what it finds. LinkedIn has already despatched enforcement threats to customers of third-party instruments, utilizing information obtained by this covert scanning to determine its targets.”
BleepingComputer has independently confirmed a part of these claims by our personal testing, throughout which we noticed a JavaScript file with a randomized filename being loaded by LinkedIn’s web site.
This script checked for six,236 browser extensions by trying to entry file sources related to a particular extension ID, a recognized approach for detecting whether or not extensions are put in.
This fingerprinting script was beforehand reported in 2025, nevertheless it was solely detecting roughly 2,000 extensions at the moment. A totally different GitHub repository from two months in the past reveals 3,000 extensions being detected, demonstrating that the variety of detected extensions continues to develop.
Supply: BleepingComputer
Whereas most of the extensions which can be scanned for are associated to LinkedIn, the script additionally unusually detected language and grammar extensions, instruments for tax professionals, and different seemingly unrelated options.
The script additionally collects a variety of browser and machine information, together with CPU core rely, out there reminiscence, display screen decision, timezone, language settings, battery standing, audio info, and storage options.
Supply: BleepingComputer
BleepingComputer couldn’t confirm the claims within the BrowserGate report about the usage of the info or whether or not it’s shared with third-party corporations.
Nonetheless, comparable fingerprinting strategies have been used prior to now to construct distinctive browser profiles, which may allow monitoring customers throughout web sites.
LinkedIn denies information use allegations
LinkedIn doesn’t dispute that it detects particular browser extensions, telling BleepingComputer that the data is used to guard the platform and its customers.
Nonetheless, the corporate claims the report is from somebody whose account was banned for scraping LinkedIn content material and violating the positioning’s phrases of use.
“The claims made on the web site linked listed here are plain improper. The particular person behind them is topic to an account restriction for scraping and different violations of LinkedIn’s Phrases of Service.
To guard the privateness of our members, their information, and to make sure website stability, we do search for extensions that scrape information with out members’ consent or in any other case violate LinkedIn’s Phrases of Service.
Right here’s why: some extensions have static sources (photographs, javascript) out there to inject into our webpages. We are able to detect the presence of those extensions by checking if that static useful resource URL exists. This detection is seen contained in the Chrome developer console. We use this information to find out which extensions violate our phrases, to tell and enhance our technical defenses, and to know why a member account is likely to be fetching an inordinate quantity of different members’ information, which at scale, impacts website stability. We don’t use this information to deduce delicate details about members.
For added context, in retaliation for this web site proprietor’s account restriction, they tried to acquire an injunction in Germany, alleging LinkedIn had violated numerous legal guidelines. The court docket dominated towards them and located their claims towards LinkedIn had no advantage, and in reality, this particular person’s personal information practices ran afoul of the legislation.
Sadly, it is a case of a person who misplaced within the court docket of legislation, however is searching for to re-litigate within the court docket of public opinion with out regard for accuracy.”
LinkedIn claims the BrowserGate report stems from a dispute involving the developer of a LinkedIn-related browser extension known as “Teamfluence,” which LinkedIn says it restricted for violating the platform’s phrases.
In paperwork shared with BleepingComputer, a German court docket denied the developer’s request for a preliminary injunction, discovering that LinkedIn’s actions didn’t represent illegal obstruction or discrimination.
The court docket additionally discovered that automated information assortment alone may infringe upon LinkedIn’s phrases of use and that it was entitled to dam the accounts to guard its platform.
LinkedIn argues the BrowserGate report is an try and re-litigate that dispute publicly.
Whatever the causes for the report, one level is undisputed.
LinkedIn’s website makes use of a fingerprinting script that detects over 6,000 extensions working in a Chromium browser, together with different information a few customer’s system.
This isn’t the primary time that corporations have used aggressive fingerprinting scripts to detect applications working on a customer’s machine.
In 2021, eBay was discovered to make use of JavaScript to carry out automated port scans on guests’ gadgets to find out whether or not they had been working numerous distant help software program.
Whereas eBay by no means confirmed why they had been utilizing these scripts, it was extensively believed that they had been used to dam fraud on compromised gadgets.
It was later found that quite a few different corporations had been utilizing the identical fingerprinting script, together with Citibank, TD Financial institution, Ameriprise, Chick-fil-A, Lendup, BeachBody, Equifax IQ join, TIAA-CREF, Sky, GumTree, and WePay.
Automated pentesting proves the trail exists. BAS proves whether or not your controls cease it. Most groups run one with out the opposite.
This whitepaper maps six validation surfaces, reveals the place protection ends, and supplies practitioners with three diagnostic questions for any instrument analysis.
