LinkedIn Secretly Scans 6,000 Browser Extensions

🔑 Enhanced Key Takeaways

• •Security researchers identified that the technique utilizes 'web accessible resources' within the manifest.json files of installed extensions to perform side-channel attacks, allowing LinkedIn to detect specific software without explicit browser permissions.
• •The practice is primarily aimed at fraud detection and bot mitigation, specifically targeting automated scraping tools or malicious extensions that inject content into the LinkedIn DOM, rather than just user tracking.
• •Browser vendors, particularly Google, have faced increased pressure to restrict the 'web_accessible_resources' API in response to this discovery, as it facilitates cross-site fingerprinting that bypasses standard privacy protections.

🛠️ Technical Deep Dive

• •The routine executes a series of 'fetch' requests to known extension-specific URLs (e.g., chrome-extension://[extension-id]/manifest.json).
• •A successful response (200 OK) confirms the extension's presence, while a failure (404 or blocked) indicates absence.
• •The 48 characteristics collected include canvas fingerprinting, WebGL renderer information, audio context analysis, and battery status API data.
• •The resulting fingerprint is hashed using a proprietary algorithm and transmitted via a custom header in XHR/Fetch requests to LinkedIn's backend infrastructure.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline