Loading story…
LinkedIn was reported to be running a hidden JavaScript fingerprinting script on its website that checks visitors’ browsers for 6,236 Chrome extensions and collects device characteristics including CPU core count, available memory, screen resolution, time zone, language settings, battery status, and storage capabilities. BleepingComputer said it independently verified the script’s presence and behavior, finding that it used randomized filenames and probed static resources associated with extension IDs to determine which add-ons were installed.
LinkedIn confirmed that it scans for extensions, saying the practice is intended to detect tools that scrape member data without permission, violate its terms of service, or generate unusual data-fetching activity that could affect platform stability. Reports said the extension list includes competing sales-intelligence tools such as Apollo, Lusha, and ZoomInfo, alongside unrelated categories like grammar and tax software, and noted the scope of the scanning had expanded from roughly 2,000 extensions to more than 6,000; questions remain about how the collected data is stored, linked to user identities, or used for enforcement.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
LinkedIn acknowledged that it scans for extensions, saying the practice is intended to identify tools that scrape member data without permission, violate its terms of service, or generate unusual data-fetching activity that could affect platform stability.
BleepingComputer said it independently confirmed the existence and behavior of the LinkedIn script, including its use of randomized filenames and requests for static resources associated with extension IDs to detect installed extensions.
Fairlinked e.V. reported that LinkedIn injects hidden JavaScript into page loads to probe for 6,236 installed Chrome extensions and collect browser and device characteristics for fingerprinting.
About two months before the April 2026 reports, a GitHub repository referenced in the coverage indicated the extension-detection list had grown to around 3,000 Chrome extensions.
According to the BrowserGate investigation, LinkedIn's active extension-detection list had grown to 5,459 entries by December 2025, indicating a major expansion of the browser-scanning system before the public April 2026 disclosures. The report says the list later increased further in early 2026.
The reported LinkedIn browser-scanning activity began at a smaller scale in 2025, when its hidden JavaScript was said to check for roughly 2,000 Chrome extensions on visitors' browsers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcezdnet.fr
Open sourcecio.com
Open sourcecio.com
Open sourcescworld.com
Open sourcehackread.com
Open sourcetomshardware.com
Open sourceghacks.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New reporting and research highlighted escalating risk from **Chrome browser extensions** that present as AI productivity or shopping tools while collecting excessive data or performing hidden monetization. An Incogni analysis of 442 “AI-branded” Chrome extensions found **more than half** collected user data and nearly a third collected **personally identifiable information (PII)**, based on requested permissions, developer disclosures, and risk scoring; the study flagged widely used tools as among the most invasive. Separately, Socket researchers identified a Chrome extension marketed as *Amazon Ads Blocker* that silently **hijacked affiliate links**, injecting the developer’s tag `10xprofit-20` into Amazon product URLs and replacing existing creator affiliate codes without user awareness. Socket assessed the affiliate-hijacking behavior as part of a broader, likely coordinated ecosystem: at least **29 related extensions** were observed targeting major e-commerce sites (including Amazon, AliExpress, Best Buy, Shopify, and Shein) using shared infrastructure and repeated policy-violating patterns, indicating intentional abuse rather than accidental noncompliance. In contrast, other contemporaneous items focused on broader consumer privacy guidance (e.g., smart TV tracking mitigations) or regulatory investigations into AI image generation on X/*Grok*; while privacy-adjacent, they do not describe the same **Chrome extension abuse** activity and are not directly actionable for extension-risk response beyond general awareness.
Jun 29, 2026
Security research attributed to **Q Continuum** reported **287 Chrome extensions** that transmit users’ **browsing history** to third parties, affecting an estimated **37.4 million installations**. The work used automated analysis (including containerized scanning and **man-in-the-middle proxy** inspection of extension traffic) to flag suspicious outbound communications consistent with URL/history leakage, and noted that some extensions use obfuscation and encryption (e.g., **ROT47** and **AES-256** with **RSA** key pairs) to conceal collection and exfiltration behavior. The identified ecosystem includes extensions tied to data-broker/analytics activity, with reporting naming **Similarweb** and related entities (including “Big Star Labs”) among organizations operating extensions implicated in history collection, alongside other groups controlling additional high-install extensions. While some data sharing may be disclosed in privacy policies, the reporting emphasized that browsing history can be highly sensitive and, even when “anonymized,” can often be re-identified, creating material privacy and compliance risk for users and organizations that allow unmanaged browser extensions.
Jun 29, 2026
Security researchers reported multiple **malicious browser extension** operations abusing official add-on stores. Socket identified five Chrome Web Store extensions impersonating productivity/security tools for **Workday, NetSuite, and SAP SuccessFactors**, installed over 2,300 times, that performed credential theft and session abuse via **cookie exfiltration**, **cookie injection for session hijacking**, and **DOM manipulation** to block security/incident-response administration pages; the extensions appeared under different publisher names but shared code structure, targeting logic, and infrastructure, indicating coordinated activity. Separately, LayerX documented continued activity in the **GhostPoster** campaign across Chrome, Firefox, and Edge, adding 17 more extensions with a combined ~840,000 installs. The extensions concealed malicious JavaScript in image assets (e.g., logo files) to fetch an obfuscated payload that monitored browsing, planted a backdoor, hijacked affiliate links, and injected invisible iframes to drive **ad/click fraud**; LayerX assessed the operation likely originated in the Edge ecosystem and later expanded, with some extensions reportedly present since 2020, suggesting long-lived persistence despite prior public exposure by Koi Security.
Jun 29, 2026