BrowserGate Alert

Social media sites are secretly scanning your browser extensions

LinkedIn, Facebook, YouTube and other major platforms use hidden JavaScript to probe your browser for 6,000+ installed extensions, collecting data about your tools, habits, and identity. JExt Scanner reveals which of your extensions are exposed.

6,000+ Extensions Tracked
6 Major Sites Scanning
100% Client-Side Privacy

Extension Scanner

This scan runs entirely in YOUR browser. No data is sent to any server.

Sites Known to Scan Extensions

These social media platforms have been identified using browser extension scanning techniques.

LinkedIn

HIGH RISK
Scans 6,000+ extensions
Technique: Web Accessible Resources probing via hidden iframe/fetch
Data Collected:
  • Installed browser extensions
  • Extension version numbers
  • Browser type and version
  • Screen resolution
  • Device type
  • OS information
  • Canvas fingerprint
Full Details

LinkedIn injects JavaScript that systematically probes chrome-extension:// URLs for thousands of known extensions. It checks for web-accessible resources (icons, CSS files) exposed by extensions. Detection occurs silently during normal page browsing via their 'li_at' tracking script.

Facebook / Meta

HIGH RISK
Scans 2,500+ extensions
Technique: DOM injection detection + resource timing
Data Collected:
  • Installed extensions
  • Ad blocker detection
  • Browser fingerprint
  • Device hardware info
  • Network information
Full Details

Facebook uses multiple techniques including checking for DOM modifications made by extensions (especially ad blockers) and resource timing attacks to detect installed extensions.

X (Twitter)

MEDIUM RISK
Scans 1,200+ extensions
Technique: Resource timing + fetch probing
Data Collected:
  • Installed extensions
  • Browser type
  • Device fingerprint
  • Ad blocker status
Full Details

X uses resource timing side-channel attacks and fetch-based probing to detect browser extensions, particularly ad blockers and privacy tools.

Instagram

MEDIUM RISK
Scans 2,000+ extensions
Technique: Meta Pixel + DOM fingerprinting
Data Collected:
  • Installed extensions
  • Browser configuration
  • Device type
  • Screen properties
Full Details

As part of the Meta ecosystem, Instagram shares the same extension detection infrastructure as Facebook, scanning for privacy and ad-blocking tools.

YouTube

HIGH RISK
Scans 3,000+ extensions
Technique: DOM mutation observer + extension resource probing
Data Collected:
  • Ad blocker extensions
  • Video download extensions
  • Browser fingerprint
  • Device information
Full Details

YouTube actively detects ad-blocking extensions through DOM mutation observers and has started blocking users with detected ad blockers. Also probes for video download and enhancement extensions.

TikTok

MEDIUM RISK
Scans 800+ extensions
Technique: Canvas fingerprinting + extension probing
Data Collected:
  • Installed extensions
  • Device fingerprint
  • Browser configuration
  • Hardware concurrency
Full Details

TikTok employs canvas fingerprinting combined with extension resource probing to build detailed browser profiles of visitors.

Protect Yourself

Steps you can take to reduce your browser extension fingerprint.

Use Incognito Mode

Extensions are disabled by default in incognito/private mode. Only enable specific extensions you need for that session.

Effectiveness: HIGH

Audit Your Extensions

Remove extensions you don't actively use. Fewer extensions = smaller fingerprint = harder to track.

Effectiveness: HIGH

Disable When Not Needed

Use browser profiles or toggle extensions off when visiting social media sites that are known to scan.

Effectiveness: MEDIUM

Use Firefox

Firefox has better extension isolation and has been working to limit web-accessible resource probing since Manifest V3.

Effectiveness: MEDIUM

Browser Profiles

Create separate browser profiles: one for social media (minimal extensions) and one for daily work.

Effectiveness: HIGH

Check Extension Permissions

Review which resources your extensions expose. Extensions with fewer web-accessible resources are harder to detect.

Effectiveness: LOW