The hidden JavaScript silently scans the computer for installed software without the user’s consent whenever a user opens LinkedIn in a Chrome-based browser. This has not been mentioned in LinkedIn’s privacy policy.
This investigation was conducted by the European advocacy group called Fairlinked e.V. The investigation campaign titled “BrowserGate” has uncovered one of the largest corporate espionage and data breach scandals in digital history.
According to the report, Microsoft’s LinkedIn is secretly running covert code that probes visitors’ browsers to identify installed extensions. After detecting the installed extensions, it compiles the results, encrypts them, and transmits them back to LinkedIn servers as well as to third-party companies.
JavaScript in LinkedIn’s bundle contains identifiers for over 6,167 browser extensions, and the scan is exclusively triggered on Chrome, Edge, Brave, Opera, and Arc through a built-in isUserAgentChrome() function check. However, Firefox and Safari users are not currently affected.
According to the findings of the investigation, the BrowserGate researchers identified several risks among the 6,222 tracked extensions. These include 509 job search tools, religious belief indicators, political orientation markers, and disability and neurodivergent tools, including 200+ direct competitor products.
Data revealing religious beliefs, political opinions, and health conditions is classified as special category data under the EU’s General Data Protection Regulation (GDPR). This data is not merely regulated but prohibited from processing without explicit consent. For this, LinkedIn has not used any consent or disclosure and has no legal basis for collecting it.
