Wikipedia

Draft:BrowserGate

BrowserGate is the name given to the disclosure, in April 2026, that LinkedIn runs hidden JavaScript on its website that checks whether visitors have any of more than 6,000 Chrome extensions installed. The script also collects hardware data such as CPU core count, screen resolution, and battery status. None of this is mentioned in LinkedIn's privacy policy.[1][2]

The findings came from Fairlinked e.V., a German nonprofit representing commercial LinkedIn users, and were independently confirmed by BleepingComputer, which ran its own tests.[1][3] LinkedIn does not deny that it scans for extensions. The company says it does so to catch tools that scrape data or break its terms of service, and that it does not use the results to infer sensitive information about users.[1] Two class-action lawsuits were filed in the United States in April 2026,[4][5] and Fairlinked filed complaints with the European Commission.[6]

Background

edit

Chromium-based browsers like Google Chrome allow extensions to bundle files that any webpage can try to load. If a page requests a file from a known extension ID and gets a response, it knows the extension is there. This has been a known fingerprinting vector for years. In a 2020 paper at the NDSS Symposium, researchers from the University of Illinois Chicago showed they could fingerprint 29,428 Chrome extensions this way, and that knowing just four of a person's extensions was enough to uniquely identify them 94.47% of the time. The same paper found that hundreds of extensions could reveal religion, health conditions, or political views.[7]

LinkedIn's data practices had already drawn regulatory action before BrowserGate. In October 2024, the Irish Data Protection Commission fined the company €310 million for using personal data for targeted advertising without valid consent under the General Data Protection Regulation.[2][8] Separately, in September 2023, the European Commission designated Microsoft as a gatekeeper under the Digital Markets Act, with LinkedIn as one of its regulated platforms. That designation obliges LinkedIn to give third-party tools access to the platform and not to disadvantage businesses that use competing products.[6]

How the scanning was discovered

edit

LinkedIn's extension scanning was not found all at once. Dan Andrews, a developer, first noticed it in 2017. He published a GitHub repository showing that LinkedIn's JavaScript was probing for 38 specific extensions, mostly recruitment tools like Daxtra Magnet.[9][10]

In 2024, Josef Kadlec, a Czech recruiter and sourcing trainer, went through LinkedIn's source code again and counted 461 extensions. He also noted that LinkedIn had started using DOM inspection to catch extensions that modify the page, not just the file-probing method Andrews had found.[11] By February 2026, when software developer Mark Percival extracted the list, it had reached roughly 3,000.[12] The Fairlinked investigation, published the following month, put the number at 6,236.[1][6]

Extension count over time
YearResearcherCount
2017Dan Andrews38
2024Josef Kadlec461
Feb 2026Mark Percival~3,000
Apr 2026Fairlinked e.V. / BleepingComputer6,236

Technical details

edit

BleepingComputer confirmed that LinkedIn loads a JavaScript file (with a randomised filename) on every page visit. The script checks for 6,236 extensions by trying to fetch a known file from each one using the chrome-extension:// URL scheme. If the file loads, the extension is present. The whole process runs silently.[1][3]

The Fairlinked report describes two additional systems on top of that. One, which LinkedIn's own code calls "Spectroscopy," walks the page's DOM looking for anything injected by an extension, even extensions not on the hardcoded list. The other collects 48 device attributes: CPU cores, memory, screen size, time zone, language, battery level, and others. All of it is encrypted with an RSA key and sent to LinkedIn's servers.[2][6][13]

Only Chromium-based browsers are affected. Firefox and Safari use different extension architectures and are not vulnerable to the same probing technique.[1][2]

What is being scanned for

edit

The extension list is not limited to scraping tools. According to the Fairlinked report, it includes over 200 products that compete with LinkedIn's own sales features (such as Apollo.io, Lusha, and ZoomInfo), 509 job search extensions, and tools related to religious observance, political filtering, and neurodivergent support.[1][3][6] Because LinkedIn accounts are tied to real names and employers, a detected extension can be linked to a specific person at a specific company. The combined install base of all scanned extensions is around 405 million.[1][6]

Some of these categories are legally sensitive. Under Article 9 of the GDPR, data that reveals religious beliefs, political opinions, or health conditions is "special category" data, and processing it requires explicit consent.[2]

Digital Markets Act questions

edit

A recurring theme in the press coverage has been the timing. The European Commission designated LinkedIn as a DMA gatekeeper in September 2023, requiring it to open up to third-party tools. The Fairlinked report and several news outlets pointed out that, according to their data, LinkedIn's scan list grew from about 461 extensions in 2024 to over 6,000 by February 2026, and that many of the added extensions are the exact tools the DMA is supposed to protect.[2][6][13][14]

There is also a question about how LinkedIn handled its compliance obligations. The Fairlinked report says LinkedIn published two restricted APIs that together handle about 0.07 requests per second, while its internal Voyager API, which runs the actual LinkedIn website and apps, processes around 163,000 per second. Microsoft's 249-page DMA compliance report to the Commission uses the word "API" 533 times but never mentions Voyager.[2][6][13]

Fairlinked filed formal complaints with the European Commission (DMA.100150 and DMA.100143).[6] LinkedIn has not responded to the DMA-specific allegations.[1]

LinkedIn's position

edit

LinkedIn told BleepingComputer it scans for "extensions that scrape data without members' consent or otherwise violate LinkedIn's Terms of Service." It said it does not use the data to infer sensitive information.[1] The company also said the person behind the BrowserGate report had been restricted from the platform for scraping and had lost a court case in Germany.[1][3]

After the US lawsuits were filed, LinkedIn gave a stronger statement to PCMag, calling the claims "a house of cards built entirely upon a fabrication" and saying it does disclose extension scanning in its privacy policy.[5] Fairlinked responded that the German case LinkedIn cited was about an account suspension, not about the scanning, and that it is under appeal.[5]

Lawsuits

edit

Two class-action complaints were filed on 7 April 2026 in federal court in San Jose. Ganan v. LinkedIn Corporation (Case 5:26-cv-02968) alleges violations of the Computer Fraud and Abuse Act and the Electronic Communications Privacy Act, among other claims.[4] A second case, brought on behalf of Nicholas Farrell, makes similar arguments and relies partly on the BrowserGate report.[5][15] The attorney in the Ganan case told Ars Technica that LinkedIn's public response "does not meaningfully deny the core conduct alleged in the complaint."[15]

In Europe, Fairlinked filed complaints with the European Commission under the DMA. A related preliminary injunction at the Regional Court of Munich I (case 37 O 104/26) was denied in March 2026 but is on appeal.[2][5] German legal commentators have also raised the question of whether the scanning could fall under Section 202a of the Strafgesetzbuch (unauthorised data access), which carries up to three years in prison.[6][13]

Coverage

edit

BleepingComputer published its verification on 3 April 2026.[1] The story was then picked up by Tom's Hardware,[3] The Next Web,[2] TechRadar,[16] Cybernews,[17] SC Media,[18] Ars Technica,[15] and others. On Hacker News, the story drew a long thread; LinkedIn's initial public comment came from an account called "LinkedinHelp."[6][13]

See also

edit
edit

Category:2026 in computing Category:Internet privacy Category:LinkedIn Category:Microsoft controversies Category:Computer law Category:European Union law

  1. 1 2 3 4 5 6 7 8 9 10 11 12 Abrams, Lawrence (3 April 2026). "LinkedIn secretly scans for 6,000+ Chrome extensions, collects data". BleepingComputer. Retrieved 10 April 2026.
  2. 1 2 3 4 5 6 7 8 9 Dina, Cristian (5 April 2026). "LinkedIn secretly scans 6,000+ browser extensions and fingerprints your device". The Next Web. Retrieved 10 April 2026.
  3. 1 2 3 4 5 James, Luke (5 April 2026). "LinkedIn is spying on you, according to a new 'BrowserGate' security report". Tom's Hardware. Retrieved 10 April 2026.
  4. 1 2 "LinkedIn faces class action over alleged covert scanning of users' browsers". CyberInsider. 7 April 2026. Retrieved 10 April 2026.
  5. 1 2 3 4 5 "LinkedIn Hit With Class-Action Lawsuits Over Browser-Extension Scanning". PCMag via Yahoo!. 7 April 2026. Retrieved 10 April 2026.
  6. 1 2 3 4 5 6 7 8 9 10 11 "BrowserGate: Executive Summary". browsergate.eu. Fairlinked e.V. March 2026. Retrieved 10 April 2026.
  7. ↑ Karami, Soroush; Ilia, Panagiotis; Solomos, Konstantinos; Polakis, Jason (23–26 February 2020). Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting. Network and Distributed Systems Security (NDSS) Symposium 2020. San Diego, CA, USA. doi:10.14722/ndss.2020.24383. ISBN 1-891562-61-4.
  8. ↑ "Irish Data Protection Commission fines LinkedIn Ireland €310 million". Data Protection Commission. 24 October 2024. Retrieved 10 April 2026.
  9. ↑ Andrews, Dan (2017). "nefarious-linkedin". GitHub. Retrieved 10 April 2026.
  10. ↑ Heer, Nick (April 2026). "Microsoft-Owned LinkedIn Allegedly Fingerprints Visitors and Scans Installed Chrome Extensions". Pixel Envy. Retrieved 10 April 2026.
  11. ↑ Kadlec, Josef (2024). "The Complete List of Blacklisted LinkedIn Plugins Vol. 3 [2024]". josefkadlec.com. Retrieved 10 April 2026.
  12. ↑ Percival, Mark (February 2026). "linkedin-extension-fingerprinting". GitHub. Retrieved 10 April 2026.
  13. 1 2 3 4 5 "BrowserGate: The Massive Microsoft-LinkedIn Espionage Scandal". The CyberSec Guru. April 2026. Retrieved 10 April 2026.
  14. ↑ "LinkedIn Is Spying on Your Browser Extensions — Report". Cyber Kendra. April 2026. Retrieved 10 April 2026.
  15. 1 2 3 "LinkedIn's scanning of users' browser extensions triggers controversy and two lawsuits". BusinessStory.org (republished from Ars Technica). 8 April 2026. Retrieved 10 April 2026.
  16. ↑ Fadilpašić, Sead (6 April 2026). "'One of the largest corporate espionage and data breach scandals in digital history': New 'BrowserGate' report claims LinkedIn secretly scans user browsers". TechRadar. Retrieved 10 April 2026.
  17. ↑ "LinkedIn secretly injects code to spy on your browser". Cybernews. 7 April 2026. Retrieved 10 April 2026.
  18. ↑ "LinkedIn accused of covert browser extension scanning in 'BrowserGate' report". SC Media. 7 April 2026. Retrieved 10 April 2026.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Draft:BrowserGate&oldid=1348381482"