Every Time You Open LinkedIn, Hidden JavaScript Scans Your Browser for 6,000 Extensions. It Knows Your Religion, Your Politics, Your ADHD Tools, and Whether You Are Secretly Job Hunting.

What Gets Scanned

The extension list is not limited to scraping tools or security threats. The BrowserGate investigation categorizes the scanned extensions into several sensitive categories that go well beyond LinkedIn's stated security justification.

Religious extensions: Tools that notify users of Islamic prayer times, provide daily Torah readings, and other faith-based browser tools. The presence of these extensions reveals an individual's religious practice.

Health and neurodivergence: Extensions designed for users with ADHD to help them focus, dyslexia aids that alter fonts and formatting, and other accessibility tools. These extensions reveal health conditions and neurodivergent status.

Political orientation: Tools that block content from specific political parties, highlight corporate political donations, and other politically aligned extensions. These reveal an individual's political beliefs.

Job search tools: Over 500 specific job search, resume building, and career management extensions. On a platform where your current employer can see your profile, LinkedIn is scanning for tools that reveal you are secretly looking for a new job.

Competitor sales tools: Over 200 products that directly compete with LinkedIn's own sales intelligence offerings, including Apollo, Lusha, ZoomInfo, and others. Because LinkedIn knows each user's employer, it can map which companies use which competitor products.

The critical distinction is that LinkedIn ties all of this data to your real identity. Most browser fingerprinting is anonymous. LinkedIn knows your name, your employer, your job title, your location, and your professional network. When LinkedIn detects that a specific individual has an ADHD focus extension, a prayer time notification, and a job search tool installed, that data is attached to a real person with a real employer.

How It Works Technically

The scanner exploits a well-documented browser behavior. Chrome extensions can expose internal files to web pages through the web_accessible_resources field in their manifest.json. When a website sends a fetch() request to chrome-extension://{extension-id}/{file}, Chrome allows the request if the extension is installed and the resource is accessible. If the extension is not installed, Chrome blocks the request.

LinkedIn maintains an array of over 6,000 extension IDs paired with specific probe target files. On every page load, the scanner iterates through the entire list, sending a fetch() request for each one. The results (installed vs. not installed) are collected, combined with hardware fingerprinting data, encrypted, and transmitted to LinkedIn's servers. The entire process runs in the background. No visual indicator. No notification. The array alone occupies approximately 409,000 characters of source code.

The system includes A/B testing flags that allow LinkedIn to enable or disable scanning for specific user segments, run experiments on scanning behavior, and roll out changes incrementally. The existence of A/B testing infrastructure for a surveillance system means LinkedIn is actively optimizing how to scan users more effectively.

The scanning is not limited to logged-in users. It executes for all visitors, including those browsing public profiles without a LinkedIn account. However, the most sensitive implications arise when scanning results are tied to authenticated sessions, where the extension fingerprint is linked to a known individual.

Why This Matters for Security Teams

This is not just a privacy story. It is a security story. Every security professional, CISO, IT director, and executive in your organization uses LinkedIn. Many use it daily. And every time they do, LinkedIn is cataloging which security, privacy, and productivity tools they have installed.

Your security team's tooling is being inventoried. If your security analysts use browser extensions for threat intelligence, OSINT research, or penetration testing, LinkedIn is recording which tools they use. That information, tied to their real name and employer, tells anyone with access to the data what your organization's security capabilities look like.

Your executives' vulnerabilities are being cataloged. If your CEO uses a password manager extension, a VPN extension, or any security tool, LinkedIn records it. If they do not, LinkedIn records that absence too. An adversary with access to extension fingerprint data could infer which individuals are security-conscious and which are not, enabling more targeted social engineering.

Your employees' job search activity is visible to the platform that shows their profile to their current employer. LinkedIn scans for over 500 job search tools. This creates a scenario where the platform that displays your professional identity to your current employer is simultaneously collecting data about whether you are secretly looking to leave. The information asymmetry is remarkable.

Defensive Takeaways

1. 1

   Use a Dedicated Browser Profile for LinkedIn

   The most effective mitigation is to open LinkedIn in a browser profile with zero extensions installed. Chrome, Edge, and Brave all support multiple profiles. Create a "LinkedIn-only" profile that is clean of all extensions. This breaks the scanning chain entirely because there is nothing to detect. If you use LinkedIn frequently, this takes 30 seconds to set up and eliminates the issue permanently. This is especially important for security professionals whose extension lists reveal their tooling and capabilities.

2. 2

   Use Firefox or Safari for LinkedIn

   The scanning technique relies on Chromium's web_accessible_resources extension API. Firefox and Safari handle extension isolation differently and are significantly harder to fingerprint using this method. Safari's extension model is particularly restrictive and does not expose the same identifiers. If switching browsers entirely is impractical, use Firefox or Safari specifically for LinkedIn while continuing to use Chrome for other work. Apple's Lockdown Mode further restricts fingerprinting surfaces.

3. 3

   Brief Your Organization on LinkedIn's Data Collection

   Most employees assume LinkedIn is a low-risk professional networking tool. BrowserGate demonstrates that LinkedIn is collecting substantially more data than most users expect, including information that can infer religious practice, health conditions, political orientation, and employment intent. Security awareness training should include guidance on LinkedIn's extension scanning. Employees who handle sensitive information or who are high-value social engineering targets (executives, finance, IT administrators) should be specifically briefed on the risk of extension fingerprinting and advised to use isolated browser profiles.

4. 4

   Audit Your Organization's Chrome Extension Exposure

   BrowserGate's public database at browsergate.eu allows you to search for specific extensions and check whether they are on LinkedIn's scan list. Run your organization's commonly deployed extensions through this database. If your security tools, VPN extensions, or internal productivity tools are on the list, LinkedIn is recording which of your employees use them. Consider whether this exposure is acceptable. For sensitive extensions, deploy them through managed browser policies that restrict web_accessible_resources to prevent external sites from probing for their presence.

5. 5

   If LinkedIn Does It, Assume Others Do Too

   The extension scanning technique LinkedIn uses is well-documented and technically simple. Any website can implement the same approach. If LinkedIn is scanning for 6,000 extensions, other platforms, advertising networks, and potentially adversary-controlled websites may be doing the same. This is not a LinkedIn-specific risk. It is a browser architecture risk. Chrome's extension model allows any website to probe for installed extensions through web_accessible_resources. Until browser vendors implement stricter controls over extension enumeration APIs, every Chromium user is exposed to this technique on every website they visit. The defense is the same: isolated browser profiles for sensitive sites, Firefox or Safari where fingerprinting resistance matters, and organizational awareness that browser extensions are part of the attack surface.