A new study called “BrowserGate” suggests that LinkedIn, owned by Microsoft, is secretly using JavaScript code on its website to examine visitors’ browsers for installed extensions and gather data about their devices.

The study, conducted by Fairlinked e.V., an organization representing commercial LinkedIn users, asserts that Microsoft’s platform inserts JavaScript code into user sessions to identify thousands of browser extensions and connect this information to individual user profiles.

The author alleges that this practice is used to collect sensitive personal and business information, as LinkedIn profiles are linked to actual identities, employers, and job titles.

“LinkedIn is scanning for more than 200 competing sales tools, like Apollo, Lusha, and ZoomInfo. Because LinkedIn knows each user’s company, it can determine which companies are using its competitors’ products. The report claims that it’s secretly extracting customer lists from software companies through users’ browsers without them knowing.”

“LinkedIn then uses this information to send warning messages to users of third-party apps, using data obtained through this hidden scanning to target them.”

BleepingComputer independently verified parts of these claims by observing a JavaScript file with a random name loaded by the LinkedIn website during testing.

This script checked for 6,236 browser extensions by trying to access file resources linked to a specific extension ID, a standard way to see if extensions are installed.

This fingerprinting script was previously identified in 2025, but then it only detected around 2,000 extensions. A different GitHub repository from two months ago shows 3,000 extensions being detected, suggesting that the number of extensions being tracked is growing.

While many of the scanned extensions relate to LinkedIn, the script also detected language and grammar tools, tax professional software, and other seemingly unrelated functions.

The script also gathers a wide range of browser and device information, including the number of CPU cores, available memory, screen size, time zone, language preferences, battery status, audio details, and storage capabilities.

BleepingComputer could not confirm the BrowserGate report’s claims regarding how the data is used or if it is shared with other companies.

However, similar fingerprinting methods have been used in the past to create unique browser profiles, which can be used to track users across different websites.

LinkedIn acknowledges that it detects specific browser extensions but tells BleepingComputer that it uses the data to protect its platform and users.

However, the company argues that the report comes from someone whose account was blocked for scraping LinkedIn content and violating its terms of service.

LinkedIn alleges that the BrowserGate report originated from a dispute involving the developer of a LinkedIn browser extension called “Teamfluence,” which LinkedIn claims it restricted for violating the platform’s rules.

In documents provided to BleepingComputer, a German court rejected the developer’s request for an injunction, finding that LinkedIn’s actions were not illegal obstruction or discrimination.

The court also found that automated data collection could violate LinkedIn’s terms of service and that it had the right to block accounts to protect its platform.

LinkedIn contends that the BrowserGate report is an attempt to publicly rehash that disagreement.

Regardless of the motives behind the report, one thing is clear.

LinkedIn’s website uses a fingerprinting script that identifies over 6,000 extensions running in a Chromium browser, along with other information about a visitor’s computer.

This isn’t the first time companies have used aggressive fingerprinting scripts to detect software on a visitor’s device.

In 2021, eBay was found to be using JavaScript to automatically scan visitors’ computers for open ports to see if they were running certain remote support programs.

While eBay never confirmed the reason for using these scripts, it was widely believed they were used to prevent fraud from compromised devices.

It was later discovered that many other companies were using the same fingerprinting script, including Citibank, TD Bank, Ameriprise, Chick-fil-A, Lendup, BeachBody, Equifax IQ connect, TIAA-CREF, Sky, GumTree, and WePay.