Fast Facts
-
Every time you visit LinkedIn using a Chrome-based browser, covert JavaScript silently scans your computer for thousands of installed browser extensions, transmitting this data back to LinkedIn and third parties without user consent or disclosure.
-
The scan can identify sensitive categories such as job search tools, religious beliefs, political leanings, health apps, and competitor products, all linked to individual profiles, raising serious privacy and GDPR concerns.
-
This covert surveillance extends beyond LinkedIn’s servers, involving third-party entities like HUMAN Security and Google, forming a vast, undisclosed tracking network that accumulates detailed device and user data.
-
Despite legal and ethical issues, the practice has expanded dramatically since 2017, prompting regulators across the EU to investigate, while users can mitigate risks by switching browsers, creating minimal-extension profiles, or enabling fingerprinting protection.
Underlying Problem
The investigation by Fairlinked e.V., under the campaign “BrowserGate,” uncovered a startling secret: LinkedIn’s Chrome-based platform silently scans users’ browsers for thousands of installed extensions without their knowledge or consent. Each time someone visits LinkedIn, a covert script executes almost instantly, identifying specific extension files and transmitting this data to LinkedIn’s servers and third-party companies like HUMAN Security and Google. This activity is especially alarming because LinkedIn ties user profiles to real names, workplaces, and other personal information, enabling it to create detailed profiles about individuals and even entire organizations, revealing their software choices, political leanings, religious beliefs, and health-related tools. This invasive data collection violates privacy laws such as GDPR, since it involves sensitive personal information without user approval. Moreover, the operation appears to serve LinkedIn’s strategic interests—using the information to target users with legal threats and monitor competitive tools—raising serious ethical and legal concerns. Notably, this extensive surveillance legacy dates back to 2017, but has since expanded dramatically, risking significant regulatory action as authorities in the EU have been alerted and legal proceedings are underway. To protect themselves, users are advised to switch browsers, disable extensions, or use privacy-enhancing tools like Brave with fingerprinting protection—steps crucial for guarding personal privacy against this silent invasion.
The core of the scandal lies in the fact that LinkedIn, a platform meant for professional networking, covertly infiltrates users’ browsers to harvest highly personal data—ranging from job searches and religious beliefs to political views and health tools—all without informing users or obtaining consent. This surveillance, which involves encrypted scripts loaded from third-party servers, occurs primarily on Chromium browsers such as Chrome, Edge, and Opera, affecting hundreds of millions of users worldwide. Essentially, the operation functions under the guise of security or performance, but it secretly compiles detailed profiles of individual users and entire organizations, possibly for competitive advantage and regulatory enforcement. The report, supported by evidence from independent researchers and legal experts, emphasizes that the practice likely breaches multiple data protection laws across jurisdictions. As regulators move to investigate and possibly curtail this pervasive data breach, affected users are urged to take immediate steps to safeguard their digital privacy and regain control over their personal information.
Critical Concerns
The issue that LinkedIn secretly searches your browser for installed extensions can pose serious threats to your business. When LinkedIn detects specific extensions, it could reveal sensitive information about your company’s tools and strategies, risking leaks or espionage. Furthermore, this clandestine activity might slow down your browsing, reduce productivity, and compromise employee privacy. If exploited by malicious actors, it could lead to targeted attacks or data breaches, damaging your reputation and customer trust. Consequently, any business ignoring this vulnerability risks operational disruptions, financial loss, and weakened security—all of which threaten long-term success.
Possible Next Steps
In today’s digital landscape, prompt identification and remediation of security threats are critical to maintaining user trust and safeguarding sensitive information. When a platform like LinkedIn employs hidden code that searches browsers for installed extensions, it raises concerns about privacy and security vulnerabilities that must be addressed swiftly to prevent exploitation.
Assessment and Identification
- Conduct thorough security scans to detect the presence of unauthorized scripts or code within the browser environment.
- Review browser extensions for any unusual or malicious behavior, paying close attention to recent installations.
Containment Measures
- Isolate affected systems to prevent potential lateral movement or data exfiltration.
- Disable suspicious or unrecognized extensions across all user devices immediately.
Eradication Strategies
- Remove or reset browser configurations to eliminate hidden scripts or malicious code.
- Clear browser caches and cookies to reset the user environment.
Recovery and Validation
- Verify that the web platform’s codebase is intact and free of unauthorized modifications.
- Ensure all browsers are updated to the latest versions, with security patches applied.
Preventive Actions
- Implement strict control over extension installation rights and sources.
- Educate users about phishing and extension risks to reduce the likelihood of future infections.
- Regularly monitor and audit browser activities and extensions.
Documentation and Reporting
- Record incidents and remediation steps for compliance and continuous improvement.
- Report vulnerabilities to relevant stakeholders for collaborative mitigation.
Continuous Monitoring
- Deploy real-time security monitoring tools specific to browser and web platform activities.
- Schedule regular vulnerability assessments to detect potential threats early.
Many of these strategies align with the NIST Cybersecurity Framework, emphasizing the importance of identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents in a timely manner.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Understand foundational security frameworks via NIST CSF on Wikipedia.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
