|
7 April 2026 (Paris, France) - From Cyber Security News:
Every time you open LinkedIn in a Chrome-based browser, hidden JavaScript silently scans your computer for installed software without your knowledge, without your consent, and without a single word in LinkedIn’s privacy policy.
A revealing investigation conducted by the European advocacy group Fairlinked e.V., under the campaign name “BrowserGate,” has uncovered what researchers describe as one of the largest corporate espionage and data breach scandals in digital history.
Microsoft’s LinkedIn, the world’s largest professional networking platform with over one billion users, is running covert code that probes visitors’ browsers for thousands of installed extensions, compiles the results, encrypts them, and transmits everything back to LinkedIn’s servers and to third-party companies.
The mechanism is technically precise and deliberately invisible. Each time a user loads a LinkedIn page, a fingerprinting script executes silently, probing for known browser extension identifiers by attempting to access files that extensions can optionally expose to websites. If a file loads, the extension is confirmed present. If not, it isn’t. The entire scan takes milliseconds, and the user sees absolutely nothing.
Right now it's only on Chromium-based browsers - though that is a lot: Google Chrome and Microsoft Edge, and Brave, Opera and Arc. Not via Firefox nor Safari.) Specifically what it looks for:
• 509 job search tools — including extensions for Indeed, Glassdoor, and Monster — exposing users secretly looking for work on the very platform where their current employer can see their profile.
• Religious belief indicators — extensions that identify practicing Muslims and other faith communities
• Political orientation markers — news source selectors and partisan fact-checking tools revealing users’ political leanings.Disability and neurodivergent tools — ADHD management apps, autism support extensions, and screen readers
• 200+ direct competitor products — including Apollo, Lusha, ZoomInfo, and Hunter.io, which LinkedIn uses to map which companies use rival sales intelligence platforms.
All illegal under the GDPR. But there is lots more here in the full article.
| 
