LinkedIn checks for 2953 browser extensions (github.com)

[removed]

I can confirm.. open up linkedIn.. hit F12 and watch the error count keep going up and up and up

Screenshots found here https://x.com/DenisGobo/status/2018334684879438150

[flagged]

Curious question: why would they check for installed extensions on one's browser?

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

> This repository documents every extension LinkedIn checks for and provides tools to identify them.

I get that the CSV lists the extensions, and the tools are provided in order to show work (mapping IDs to actual software). But how was it determined that LinkedIn checks for extensions with these IDs?

And is this relevant for non-Chrome users?

I suggest everyone take a look at the list of extensions and their names for some very important context: https://github.com/mdp/linkedin-extension-fingerprinting/blo...

I didn't find popular extensions like uBlock or other ad blockers.

The list is full of scammy looking data collection and AI tools, though. Some random names from scrolling through the list:

- LinkedGPT: ChatGPT for LinkedIn

- Apollo Scraper - Extract & Export Apollo B2B Leads

- AI Social Media Assistant

- LinkedIn Engagement Assistant

- LinkedIn Lead Magnet

- LinkedIn Extraction Tool - OutreachSheet

- Highperformr AI - Phone Number and Email Finder

- AI Agent For Jobs

These look like the kind of tools scummy recruiters and sales people use to identify targets for mass spamming. I see several AI auto-application tools in there too.

Looks like Firefox is immune.

This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif...

On Firefox, web accessible resources are available at "moz-extension://<extension-UUID>/myfile.png" <extension-UUID> is not your extension's ID. This ID is randomly generated for every browser instance. This prevents websites from fingerprinting a browser by examining the extensions it has installed. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

    https://fingerprint.com/
    https://coveryourtracks.eff.org/
    https://abrahamjuliot.github.io/creepjs/

Another thing... they alter the localStorage & sessionStorage prototype, by wrapping the native ones with a wrapper that prevent keys that not in their whitelist from being set.

You can try this by opening devtools and setting

  localStorage.setItem('hi', 123)

See also: a demo page for the same technique that can enumerate many extensions installed in your browser: https://browserleaks.com/chrome

I wrote an article about it a couple of months ago. I also explain why, how and a way to prevent it.

https://javascript.plainenglish.io/the-extensions-you-use-ar...

Setup a quick CDP connection. Have Claude Code attach and inject JS into Page.addScriptToEvaluateOnNewDocument. Loads before the page.

Typical early hooks: • fetch wrapper • XMLHttpRequest.prototype.open/send wrapper • WebSocket constructor wrapper • history.pushState/replaceState wrapper • EventTarget.addEventListener wrapper (optional, heavy) • MutationObserver for DOM diffs • Error + unhandledrejection capture

    cut -d',' -f2 chrome_extensions_with_names_all.csv | grep -c "AI"
    474

Only 16%!?

I’m probably on the list. I made a LinkedIn Redactor that allowed you to add keywords and remove posts from your thread that included such words. It’s the X feature but for LinkedIn. Anyway, got a cease and desist from those lame fucks at LI. So I removed from the chrome store but it’s still available on GitHub.

I wrote a blog post recently about the technique used by LinkedIn to do extension probing, as well as other ways to do it with less side effects

https://blog.castle.io/detecting-browser-extensions-for-bot-...

Chrome is the new IE6. Google set themselves up to be the next Microsoft and is "ad friendly" in all the creepy ways because that's what Google IS an ad company. All they've contributed to security is diminishing the capability of adblockers and letting malware to do bad things to you as consumers.

I wonder if this is why the linkedin feed blocker I installed in Firefox 2 weeks ago stopped working for me within 24 hours

So it really is espionage at all levels.

LinkedIn is the worst walled garden of all of them.

const nameA = getName(a).toLowerCase(); const nameB = getName(b).toLowerCase(); return nameA.localeCompare(nameB);

const msg = createDoneMessage(); msg.style.opacity = '1';

    console.log("Extensions sorted alphabetically!");
    console.table(sortedCards.map(c => ({
        name: getName(c),
        id: c.id || '—'

Looks like this has been known since 2019.

https://www.nymeria.io/blog/linkedins-war-on-email-finder-ex...

So every Chrome extension that wants to avoid being detected this way needs to proxy fetch() on the target site, imagining someone with a bunch of them installed having every legit HTTP request on the target site going through a big stack of proxies

We live in the best timeline.

The list of extensions being scanned for are pretty clear and obvious. What is really interesting to me are the extensions _not_ being scanned for that should be.

The big one that comes to mind is "Contact Out" which is scan-able, but LinkedIn seems to pretend like it doesn't exist? Smells like a deal happened behind the scenes...

https://chromewebstore.google.com/detail/email-finder-by-con...