<![CDATA[There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/]]>There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:
https://browsergate.eu/

The website claims "LinkedIn is Illegally Searching Your Computer", and implies the purpose is to find "religious beliefs, political opinions, disabilities".

tl;dr:
- yes, LinkedIn is scanning through a list of 6k+ extensions on Chrome;
- yes, this is bad;
- but the website is disingenuous in making unnecessarily overblown claims.

🧵

]]>https://board.circlewithadot.net/topic/c3573e71-30bb-4845-9844-94eb9ea1b809/there-is-a-fresh-thing-going-around-about-linkedin-scanning-extensions-installed-in-chrome-chromium-https-browsergate.euRSS for NodeMon, 06 Apr 2026 01:13:49 GMTThu, 02 Apr 2026 21:21:17 GMT60<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 21:31:23 GMT]]>@rysiek @Orca No, Firefox has random IDs locally: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/web_accessible_resources

It's still accessible, just isn't known. And enumeration would be hard.

]]>https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342907442302756https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342907442302756Fri, 03 Apr 2026 21:31:23 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 21:25:24 GMT]]>@rozie @Orca either way, both browsers have fixed IDs for extensions, but only one of the browsers decides to make them available from within the web context.

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116342883898066750https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116342883898066750Fri, 03 Apr 2026 21:25:24 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 21:23:17 GMT]]>@rysiek @Orca Ah, you mean external ID (name? 🤔). I mean internal one. It's random in case of Firefox. But it's fixed and the same as the external external one in Chromium. That's why extension's files can be accessed.

]]>https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342875606857782https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342875606857782Fri, 03 Apr 2026 21:23:17 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 21:10:32 GMT]]>@rozie @Orca Firefox absolutely has fixed IDs for extensions; for example "uBlock0@raymondhill.net" is the fixed ID for uBlock Origin and you can use it in policies.json to automagically install it and configure it (say, when you are deploying to a fleet of laptops).

For example:
https://support.mozilla.org/gl/questions/1271181

This also answers the question of "why are fixed IDs for extensions necessary".

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116342825468004146https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116342825468004146Fri, 03 Apr 2026 21:10:32 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 21:01:40 GMT]]>@rysiek @Orca For what things fixed IDs are necessary? And why Firefox doesn't have fixed IDs, then?

]]>https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342790583872660https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342790583872660Fri, 03 Apr 2026 21:01:40 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 19:52:21 GMT]]>@rozie @Orca this is correct. But extensions would have had fixed IDs anyway, these are needed for other things. The problem is making it possible for fetch(chrome-extension://<extension_id>/some/file.ext) to work.

Yes, that requires the extension to declare the file via web_accessible_resources, so yes, this is also partially on the extension vendors. But this is such a glaring privacy problem that one can and should blame Google for not closing this hole.

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116342518016880943https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116342518016880943Fri, 03 Apr 2026 19:52:21 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 19:10:18 GMT]]>@Orca @rysiek I'll need to take a closer look how exactly it's made.

I was aware of the technique where extension interacting with the site (so, in a way, trusting it, but only in a way) was also allowing this site to interact with own files. With fixed ID it allowed to check if extension is present. And this is one of described techniques. Those extensions probably declare interaction with LI (or any site) via web_accessible_resources.

Without fixed ID it (fetch of the file) wouldn't work.

]]>https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342352666097179https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116342352666097179Fri, 03 Apr 2026 19:10:18 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 14:24:19 GMT]]>@rozie@mastodon.online @rysiek@mstdn.social
I don't think extensions having static IDs are the problem. My problem is: why is an external website allowed to access extension assets (without extension allowing it explicitly)? That sounds like a security nightmare.]]>https://board.circlewithadot.net/post/https://nya.one/notes/akmk6xua2bqw0vujhttps://board.circlewithadot.net/post/https://nya.one/notes/akmk6xua2bqw0vujFri, 03 Apr 2026 14:24:19 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 14:06:30 GMT]]>@Orca @rysiek This is trusted website. But yes, it's feature by Google, present in Chromium for years - extensions have fixed IDs.

]]>https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116341158089520961https://board.circlewithadot.net/post/https://mastodon.online/users/rozie/statuses/116341158089520961Fri, 03 Apr 2026 14:06:30 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 11:54:56 GMT]]>@rysiek Thanks for the write-up of the details

Website is classic use case of seeking for attention with clickbait titles - we all can do better than that

It took time to figure out that mentioned fingerprinting is limited to Chromium based browsers and use of extensions

]]>https://board.circlewithadot.net/post/https://social.gyt.is/users/gytisrepecka/statuses/01KN9K4GQTD9WXRBZ018HGN7KPhttps://board.circlewithadot.net/post/https://social.gyt.is/users/gytisrepecka/statuses/01KN9K4GQTD9WXRBZ018HGN7KPFri, 03 Apr 2026 11:54:56 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 11:35:11 GMT]]>@clickhere Article 9, the first point:
https://gdpr-info.eu/art-9-gdpr/

> Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

IANAL, I am not saying 100% illegal, but an argument can be made…

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116340563081986034https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116340563081986034Fri, 03 Apr 2026 11:35:11 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 11:17:43 GMT]]>@rysiek Thank you, I was wondering about a potentially-unlawful-under-GDPR aspect to this. Much obliged.

]]>https://board.circlewithadot.net/post/https://mastodon.ie/users/clickhere/statuses/116340494412014505https://board.circlewithadot.net/post/https://mastodon.ie/users/clickhere/statuses/116340494412014505Fri, 03 Apr 2026 11:17:43 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 08:57:10 GMT]]>@rysiek

It is good and heartening to see nuanced reflections like these. Thank you, Rysiek!

]]>https://board.circlewithadot.net/post/https://social.coop/users/smallcircles/statuses/116339941751971805https://board.circlewithadot.net/post/https://social.coop/users/smallcircles/statuses/116339941751971805Fri, 03 Apr 2026 08:57:10 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 08:22:33 GMT]]>@rysiek
The browsergate site is odd.

Fairlinked - Allianz für digitale Fairness e.V that seem to be behind it seem to be some sort of training org made up of folks all with datacentre industry backgrounds, AWS etc.
A few red flags for me in this story

]]>https://board.circlewithadot.net/post/https://metalhead.club/users/Doomstrike/statuses/116339805614806136https://board.circlewithadot.net/post/https://metalhead.club/users/Doomstrike/statuses/116339805614806136Fri, 03 Apr 2026 08:22:33 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 00:52:41 GMT]]>@schnittchen right?!

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116338036659440811https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116338036659440811Fri, 03 Apr 2026 00:52:41 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Fri, 03 Apr 2026 00:51:45 GMT]]>And thank you to @martijn_grooten for some additional input as well!

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116338033025135194https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116338033025135194Fri, 03 Apr 2026 00:51:45 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 22:39:28 GMT]]>@vantiss @rysiek
ehh.
microsoft's malfeasace is bigger than any of us.]]>https://board.circlewithadot.net/post/https://fe.disroot.org/objects/ec3fe3d0-0ec3-4056-9f8a-73a3897ceb08https://board.circlewithadot.net/post/https://fe.disroot.org/objects/ec3fe3d0-0ec3-4056-9f8a-73a3897ceb08Thu, 02 Apr 2026 22:39:28 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 22:19:20 GMT]]>@moses_izumi @rysiek
huh? he was referring to my link to the 2017 repo, not the stuff from kopper

]]>https://board.circlewithadot.net/post/https://social.treehouse.systems/users/vantiss/statuses/116337433664643308https://board.circlewithadot.net/post/https://social.treehouse.systems/users/vantiss/statuses/116337433664643308Thu, 02 Apr 2026 22:19:20 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 22:07:20 GMT]]>@rysiek @vantiss
For the record, I'm the guy who pointed her to @kopper 's report.
(no hard feelings about stolen credit)]]>https://board.circlewithadot.net/post/https://fe.disroot.org/objects/85446bee-f1db-4926-ab8a-097d9761076ahttps://board.circlewithadot.net/post/https://fe.disroot.org/objects/85446bee-f1db-4926-ab8a-097d9761076aThu, 02 Apr 2026 22:07:20 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 22:06:26 GMT]]>@rysiek why ffs is this even possible?

]]>https://board.circlewithadot.net/post/https://tech.lgbt/users/schnittchen/statuses/116337382947612694https://board.circlewithadot.net/post/https://tech.lgbt/users/schnittchen/statuses/116337382947612694Thu, 02 Apr 2026 22:06:26 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 22:02:01 GMT]]>@rysiek@mstdn.social wtf why does Chrome allows an untrusted website to do that???]]>https://board.circlewithadot.net/post/https://nya.one/notes/akll3oju2bqw0ub7https://board.circlewithadot.net/post/https://nya.one/notes/akll3oju2bqw0ub7Thu, 02 Apr 2026 22:02:01 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 21:58:34 GMT]]>Also go see what @vantiss has to say about it:
https://social.treehouse.systems/@vantiss/116336811478744261

Credit where credit's due, I relied on her research on the earliest known instance of LinkedIn using this technique.

If you want to boost something, go boost her toot!

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116337352015614661https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116337352015614661Thu, 02 Apr 2026 21:58:34 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 21:55:28 GMT]]>@jrp

]]>https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116337339795402046https://board.circlewithadot.net/post/https://mstdn.social/users/rysiek/statuses/116337339795402046Thu, 02 Apr 2026 21:55:28 GMT<![CDATA[Reply to There is a fresh thing going around about LinkedIn scanning extensions installed in Chrome/Chromium:https://browsergate.eu/ on Thu, 02 Apr 2026 21:54:57 GMT]]>@rysiek Thanks for this analysis. I saw the BrowserGate thing earlier and it seemed bad but also way overblown, but I was not sure if I was missing something.

]]>https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/skylark13/statuses/116337337809547571https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/skylark13/statuses/116337337809547571Thu, 02 Apr 2026 21:54:57 GMT