LinkedIn Scans Browsers for Extensions, Device Data

A new investigation has revealed that LinkedIn employs JavaScript code on its website to scan visitors' browsers for thousands of installed extensions and gather device information, raising concerns about user privacy on the professional networking platform.

The practice, detailed in a report by the European advocacy group Fairlinked e.V., involves a script that activates on every page load for users of Chromium-based browsers such as Chrome and Edge. According to independent verification by cybersecurity researchers, the code probes for approximately 6,200 extensions by attempting to access specific file resources associated with their identifiers, a standard detection method. If the resource loads, the extension is confirmed as installed. The script also collects telemetry data including CPU core count, available memory, screen resolution, time zone, language settings, battery status, and storage details.

This fingerprinting occurs without explicit user notification in LinkedIn's privacy policy, though the platform requires users to log in with real identities tied to employers and job titles. As a result, the gathered data can be linked to specific individuals. The scanned...