A new report called “BrowserGate” suggests that LinkedIn, owned by Microsoft, is using hidden JavaScript on its website to identify browser extensions and gather device information.

According to Fairlinked e.V., an organization representing commercial LinkedIn users, the platform includes JavaScript in user sessions that searches for thousands of browser extensions and links this data to specific user profiles.

The report claims this lets LinkedIn collect sensitive personal and business data, because LinkedIn profiles are linked to actual people, employers, and job positions.

“LinkedIn is checking for over 200 products that directly compete with its services, like Apollo, Lusha, and ZoomInfo. Because LinkedIn knows who employs each user, it can see which companies use competing products. It’s secretly taking customer lists from software companies directly from their users’ browsers,” the report states.

“Then it uses that information. LinkedIn has already threatened users of third-party tools, using the data it secretly collected to find them.”

BleepingComputer independently verified some of these statements by finding a JavaScript file, with a randomly generated name, being loaded by LinkedIn’s site.

This script checked for 6,236 browser extensions by trying to access file resources related to each extension ID, a common technique for extension detection.

This fingerprinting script was previously reported in 2025, but it was only detecting about 2,000 extensions at that time. Another GitHub repository from two months ago shows 3,000 extensions being detected, indicating the number of detected extensions is increasing.

While many of the scanned extensions are LinkedIn-related, the script also detected language and grammar tools, tax software, and other seemingly unrelated items.

The script also gathers various data about browsers and devices, like the CPU core count, available memory, screen resolution, timezone, language settings, battery status, audio information, and storage.

BleepingComputer couldn’t confirm the BrowserGate report’s claims about how this data is used or if it’s shared with other companies.

However, similar fingerprinting methods have been used to make unique browser profiles, which allows users to be tracked across different websites.

LinkedIn admits to detecting browser extensions, telling BleepingComputer it does this to protect the platform and its users.

But the company claims the report comes from someone whose account was banned for scraping LinkedIn data and breaking the site’s terms of service.

LinkedIn says the BrowserGate report is related to a dispute with the creator of a LinkedIn browser extension called “Teamfluence,” which LinkedIn claims was restricted for violating the platform’s rules.

In documents shared with BleepingComputer, a German court rejected the developer’s request for an emergency order, saying LinkedIn’s actions weren’t unlawful or discriminatory.

The court also ruled that automated data collection can break LinkedIn’s terms and that LinkedIn can block accounts to protect its platform.

LinkedIn says the BrowserGate report is an attempt to publicly re-argue that legal dispute.

Regardless of the reasons behind the report, one thing is certain.

LinkedIn’s website uses a script to identify over 6,000 extensions running in a Chromium browser, along with other details about a visitor’s system.

This isn’t the first instance of companies using fingerprinting scripts to find programs running on a visitor’s device.

In 2021, eBay was found to use JavaScript to scan visitors’ devices for open ports to see if they were running remote support software.

While eBay never stated why it used these scripts, it was widely believed they used it to prevent fraud on hacked devices.

It was later discovered that other companies were using the same fingerprinting script, including Citibank, TD Bank, Ameriprise, Chick-fil-A, Lendup, BeachBody, Equifax IQ connect, TIAA-CREF, Sky, GumTree, and WePay.