LinkedIn Is Scanning Your Browser Extensions

What LinkedIn Is Actually Doing to Your Browser

An investigation published on April 27 by Fairlinked e.V., a European commercial LinkedIn users association, revealed a three-part surveillance system running silently on LinkedIn's website. BleepingComputer independently confirmed the findings ^[1].

Here's how it works:

Part 1: Active Extension Detection (AED). LinkedIn loads a 2.7-megabyte JavaScript bundle that fires requests targeting 6,167 specific Chrome Web Store extension IDs. It uses two methods (parallel batch scanning and staggered sequential probing) to figure out which extensions you have installed by requesting their web-accessible resources ^[2].

Part 2: Passive DOM Scanning ("Spectroscopy"). The system crawls your entire page DOM looking for chrome-extension:// references. Even extensions that aren't on the known list get caught if they inject any visible elements into the page ^[2].

Part 3: Device Fingerprinting (APFC/DNA). LinkedIn collects 48 distinct browser characteristics: CPU cores, memory, screen resolution, timezone, battery status, audio hardware, canvas fingerprints, WebGL data, and AudioContext signatures. It even records whether you have "Do Not Track" enabled. Then it ignores it. The whole bundle gets encrypted with RSA using a key identified as "apfcDfPK" and attached to every API request ^[2].

All of this happens in the background. No pop-up. No consent dialog. Nothing in LinkedIn's privacy policy mentions extension scanning ^[3].

Your Extensions Reveal More Than You Think

This isn't just about catching scrapers. The 6,167-extension list includes ^[2][3]:

• 200+ competing sales tools: Apollo, Lusha, ZoomInfo, and other platforms that compete with LinkedIn's Sales Navigator
• Religious practice extensions: tools used by practicing Muslims and other faiths
• Political interest tools: extensions that reveal political orientation
• Neurodivergent aids: accessibility tools built for specific cognitive needs
• 509 job search tools: the kind you'd install if you were secretly looking for a new job

Under GDPR, religious beliefs, political opinions, and health data are classified as "special category" data. Processing them without explicit consent is illegal in the EU ^[3].

And the list is growing fast. LinkedIn tracked 38 extensions in 2017. By 2024, it was 461. By February 2026: 6,167, a 1,252% increase in two years ^[2].

LinkedIn Isn't the Only One Watching

The investigation found LinkedIn shares collected data with third parties through hidden iframes and tracking cookies ^[2]:

• HUMAN Security (formerly PerimeterX): an American-Israeli cybersecurity firm receives data via cross-origin postMessage through hidden iframes
• Google reCAPTCHA v3: loaded on every LinkedIn page with an "onPageLoad" action, meaning Google gets a signal every time you visit
• Merchant Pool: a separate fingerprinting script that receives session cookies

LinkedIn's parent company Microsoft paid $26.2 billion for the platform in 2016. Microsoft hasn't commented on the extension scanning ^[3].

The Lawsuit: Six Counts of Federal and State Law Violations

On April 7, 2026, the Law Office of J.R. Howell filed a proposed nationwide class action against LinkedIn Corporation in the U.S. District Court for the Northern District of California ^[4].

The complaint lays out six causes of action under federal and California privacy law, including violations of the Federal Wiretap Act and California's wiretapping and computer fraud statutes ^[4].

From the filing: "This system can identify a user's religion, their political views, whether they have a disability, and whether they are secretly looking for work" ^[4].

The lawsuit seeks compensatory and punitive damages, statutory damages of $5,000 per violation, and an injunction to halt the scanning and delete all collected data ^[4].

This isn't LinkedIn's first privacy rodeo. In October 2024, Ireland's Data Protection Commission fined LinkedIn €310 million for processing personal data without valid consent ^[3].

LinkedIn Says It's Protecting the Platform. Not Everyone Agrees.

LinkedIn's response: "We use this data to determine which extensions violate our terms, to inform and improve our technical defenses, and to understand why a member account might be fetching an inordinate amount of other members' data" ^[5].

The company called the investigation's claims "plain wrong" and pointed out that Fairlinked has connections to a company whose accounts were restricted for scraping violations ^[5].

Security researcher Tyler Reguly of Fortra ran his own independent tests. His conclusion: the controversy is overblown. "Yes, LinkedIn was probing for a lot of extensions, but there was no scanning of your computer and no malicious code, just a simple JavaScript technique to determine if the extension was there," Reguly said ^[5].

Reguly also found that LinkedIn could only detect about 2,000 of the 6,000+ listed extensions in practice, and that many of the probed extensions were genuinely problematic: scrapers, data extractors, and tools that violate LinkedIn's terms of service ^[5].

But here's the issue: even if LinkedIn's intent is defensive, scanning for religious apps and disability tools goes well beyond catching scrapers. And doing it without disclosure or consent (while sharing the results with third parties) is exactly the kind of behavior that privacy laws were written to prevent.

How to Protect Yourself

Switch to Firefox. LinkedIn's extension scanner uses Chrome Web Store IDs. Firefox uses moz-extension:// URLs with randomized UUIDs, making it completely immune to the Active Extension Detection scanning. This is the single most effective step ^[2].

If you stick with Chrome, Edge, or Brave:

• Disable extensions you don't actively need before visiting LinkedIn
• Use a separate browser profile for LinkedIn with no extensions installed
• Consider a browser extension that blocks LinkedIn's tracking scripts (ironic, but effective)

For maximum protection: Firefox with privacy.resistFingerprinting enabled blocks both the extension scanning and most of the device fingerprinting ^[2].

Safari users: You're also immune to the extension scanning (Safari uses safari-web-extension:// and LinkedIn's code checks for "Chrome" in the user agent), though some fingerprinting still works ^[2].

There is no opt-out button. LinkedIn doesn't offer one.

The Bigger Picture

LinkedIn has over a billion users. If even a fraction of them use Chrome (and most do) the combined user base of the scanned extensions amounts to roughly 405 million people ^[3]. That makes this one of the largest undisclosed data collection operations on the commercial internet.

The investigation also flagged potential violations of the EU's Digital Markets Act. LinkedIn allegedly built the scanning system partly to identify users of competing sales tools, which is the opposite of the interoperability the DMA requires ^[2].

The scanning runs during CPU idle time, making it hard to notice. It operates entirely within the browser, so no antivirus or firewall will catch it. And because it happens on LinkedIn's own website (a site people visit voluntarily) the legal defense is simpler than if it were malware.

But "it's not malware" is a pretty low bar for a company that controls professional networking for most of the working world.

References

1. The Next Web: "LinkedIn secretly scans 6,000+ browser extensions and fingerprints your device" (April 2026)
2. Security Affairs: "LinkedIn BrowserGate" (April 2026)
3. BrowserGate.eu: "US Class Action Suit over BrowserGate" (April 7, 2026)
4. BrowserGate.eu: US District Court filing details (April 7, 2026)
5. SecurityWeek: "BrowserGate: Claims of LinkedIn 'Spying' Clash With Security Research Findings" (April 2026)