LinkedIn's Covert Browser Scanning Exposed in BrowserGate Report

Bleepingcomputer

LinkedIn's Covert Browser Scanning Exposed in BrowserGate Report

First seen 3 Apr 2026, 20:58 UTC • •65.0

Article Content

1 / 12

Browse articles

ThreatCluster •April 4, 2026 at 20:29 UTC

•LinkedIn scans users' computers for over 6,000 browser extensions without consent.
•Data collected includes sensitive personal information and competitor tool usage.
•Legal actions may be initiated against LinkedIn for privacy violations.

A report by Fairlinked e.V. reveals that LinkedIn is secretly scanning the computers of its one billion users for installed software and browser extensions without consent. This covert operation, dubbed 'BrowserGate', utilizes hidden JavaScript to collect data on over 6,000 extensions, including those related to competitors and sensitive personal information. The scanning method links results to identifiable user profiles, allowing LinkedIn to map which companies use competing products. The report suggests that this data is used to identify and threaten users of third-party tools. LinkedIn's practices have raised significant concerns regarding privacy violations and corporate espionage. The company has not denied the scanning but claims it is for user protection. Investigations are ongoing, and legal actions may follow as the implications of this surveillance unfold.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 189d ago How this analysis works

Timeline

2023-01-01

EU designates LinkedIn as a regulated gatekeeper under the Digital Markets Act.

2024-02-01

LinkedIn's scanning list grows from 461 to over 6,000 extensions.

2026-04-02

BrowserGate report published by Fairlinked e.V.

2026-04-03

BleepingComputer confirms parts of BrowserGate claims.

2026-04-04

Gbhackers and Cybersecuritynews publish articles on BrowserGate.

More articles in this cluster (11)

Threat Graph

4 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Campaign (1)

BrowserGate

Affected Platform (1)

Chromium

Tool (1)

JavaScript

Relationships

Data Breach targets Chromium
BrowserGate related to JavaScript

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…