LinkedIn checks for 2953 browser extensions • Hacker News Board

Re: LinkedIn checks for 2953 browser extensions

#11

Post by 0cf8612b2e1e » Thu, Feb 05, 2026, 8:24 PM UTC

ronsor wrote: post #5

lapcat wrote: post #2

[removed]

This is a security vulnerability and should be patched. Sorry, LinkedIn. (Alternatively extension developers can modify their extensions to block these requests!)

No kidding. I am shocked this works.

Does Firefox have a similar weakness?

Re: LinkedIn checks for 2953 browser extensions

#12

Post by staticshock » Thu, Feb 05, 2026, 8:25 PM UTC

mongrelion wrote: post #7

Curious question: why would they check for installed extensions on one's browser?

For a social network, more information about their users = better ad targeting. It likely gets plumbed into models to inform user profiles.

Re: LinkedIn checks for 2953 browser extensions

#13

Post by toomuchtodo » Thu, Feb 05, 2026, 8:25 PM UTC

ronsor wrote: post #5

lapcat wrote: post #2

[removed]

This is a security vulnerability and should be patched. Sorry, LinkedIn. (Alternatively extension developers can modify their extensions to block these requests!)

Is there no browser setting to defend against this attack? If not, there should be, versus relying on extension authors to configure or enable such a setting.

Re: LinkedIn checks for 2953 browser extensions

#14

Post by Nextgrid » Thu, Feb 05, 2026, 8:25 PM UTC

jppope wrote: post #9

mongrelion wrote: post #7

Curious question: why would they check for installed extensions on one's browser?

most automations for sales and marketing use browser extensions... linkedIn wants you using their tools not 3rd party

Their own tools suck, that’s the issue.

Re: LinkedIn checks for 2953 browser extensions

#15

Post by rdoherty » Thu, Feb 05, 2026, 8:27 PM UTC

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

Re: LinkedIn checks for 2953 browser extensions

#16

Post by hsbauauvhabzb » Thu, Feb 05, 2026, 8:30 PM UTC

rdoherty wrote: post #15

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

Re: LinkedIn checks for 2953 browser extensions

#17

Post by halapro » Thu, Feb 05, 2026, 8:30 PM UTC

lapcat wrote: post #2

[removed]

If this is true, it's insane that this would work:

- why does CWS respond to cross-site requests?

- why is chrome sending the credentials (or equivalent) in these requests?

- why is the button enabled server-side and not via JS? Google must be confident in knowing the exact and latest state of your installed extensions enough to store it on their servers, I guess

Re: LinkedIn checks for 2953 browser extensions

#18

Post by 9021007 » Thu, Feb 05, 2026, 8:33 PM UTC

minkeymaniac wrote: post #3

I can confirm.. open up linkedIn.. hit F12 and watch the error count keep going up and up and up Screenshots found here https://x.com/DenisGobo/status/2018334684879438150

xcancel link: https://xcancel.com/DenisGobo/status/2018334684879438150

Re: LinkedIn checks for 2953 browser extensions

#19

Post by charcircuit » Thu, Feb 05, 2026, 8:33 PM UTC

hsbauauvhabzb wrote: post #16

rdoherty wrote: post #15

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

Why frame what you are trying to say like that? Businesses of all sizes deserve the ability to protect their businesses from abuse.

Re: LinkedIn checks for 2953 browser extensions

#20

Post by xp84 » Thu, Feb 05, 2026, 8:34 PM UTC

hsbauauvhabzb wrote: post #16

rdoherty wrote: post #15

Skimming the list, looks like most extensions are for scraping or automating LinkedIn usage. Not surprising as there's money to be made with LinkedIn data. Scraping was a problem when I worked there, the abuse teams built some reasonably sophisticated detection & prevention, and it was a constant battle.

Wont someone think of poor little LinkedIn, a subsidiary of one of the largest data brokers in the world?

I mean, regardless of who they are or even if you don’t like what LinkedIn does themselves with the data people have given them, the random third parties with the extensions don’t additionally deserve to just grab all that data too, do they?