Loading audit database
Fetching snapshot Nov 2026 from Google Cloud Storage. Hang tight...
Is __SO_NAME__ safe on LinkedIn in 2026?
No β LinkedIn detects __SO_NAME__ (we checked it ). __SO_NAME__'s extension ID is on LinkedIn's AED detection list (Nov 2026 snapshot), and LinkedIn's page code checks for __SO_NAME__ on every visit by requesting chrome-extension://__SO_ID__/__SO_PROBE__ β a file that exists only if __SO_NAME__ is installed.
Does LinkedIn detect __SO_NAME__?
This browser extension is actively compiled into LinkedIn's frontend detection lists. LinkedIn's scripts can detect when this is active on your browser.
What this means: detection isn't an instant ban β it's one input to LinkedIn's risk score. But it's a standing signal: it stacks with your behavior (volume, programmatic clicks) and device fingerprint, and this is just the AED list β one of LinkedIn's three detection systems (see how it works).
How LinkedIn checks for __SO_NAME__: the AED probe
That verdict isn't a guess. This is what LinkedIn's own page code does on every visit β simplified from its production bundle, which the BrowserGate investigation reverse-engineered line by line:
// chrome-extension://__SO_ID__/__SO_PROBE__
How LinkedIn fingerprints your browser while you use __SO_NAME__
Even after a cookie is copied out, LinkedIn keeps one more receipt on every request that follows β a 48-point snapshot of the exact machine making it. Faking it convincingly means reproducing that machine's quirks, not just editing a string.
Click any signal above for what it means. These are illustrative values β this demo never reads your actual device.
Canvas render hash: Draws a hidden shape and hashes the pixels β GPU/driver quirks make it near-unique. (illustrative β e.g. a1f9β¦3e0c)
WebGL parameters: 65+ GPU/renderer values read straight from the graphics driver. (illustrative β e.g. ANGLE (Apple, M2 Pro))
AudioContext: Plays an inaudible tone and hashes tiny hardware-specific waveform differences. (illustrative β e.g. 124.0432β¦)
Installed fonts: Measures text rendering to infer which fonts are installed on your machine. (illustrative β e.g. 38 fonts)
Local IP (WebRTC): A WebRTC leak reveals your real local network IP, even behind a VPN. (illustrative β e.g. 192.168.1.x)
Timezone Γ2: Checked two different ways β a mismatch between them is itself a signal. (illustrative β e.g. Europe/Warsaw)
Hardware & OS: CPU core count, device memory, screen size/depth, platform string. (illustrative β e.g. 8 cores Β· macOS)
navigator.webdriver: Chrome's own automation flag β true when a page is driven by Selenium/Puppeteer. (illustrative β e.g. false)
Cameras & mics: Enumerates connected media devices without asking permission to use them. (illustrative β e.g. 1 camera Β· 2 mics)
Incognito flag: A filesystem-quota heuristic that detects private-browsing mode. (illustrative β e.g. false)
This extension runs inside your real browser, so its requests always carry your real fingerprint β that isn't something it controls, it's simply where its code executes.
Is __SO_NAME__ safe on LinkedIn in 2026?
Risky β LinkedIn fingerprinted __SO_NAME__ (we checked it ), and __SO_NAME__ has since been removed from the Chrome Web Store (Nov 2026 snapshot). If an old copy of __SO_NAME__ is still installed, LinkedIn keeps detecting it on every visit.
Does LinkedIn detect __SO_NAME__?
LinkedIn audited this extension and fingerprinted its files in its client code. Since then, the extension has been removed or delisted from the Chrome Web Store (either by Google for policy violations, or by the developers to avoid bans).
Scanning risk: If you currently have an old package of this extension active on your drive, LinkedIn continues to scan your browser using HTTP requests to its unique internal files.
How LinkedIn checks for __SO_NAME__: the AED probe
That verdict isn't a guess. This is what LinkedIn's own page code does on every visit β simplified from its production bundle, which the BrowserGate investigation reverse-engineered line by line:
// chrome-extension://__SO_ID__/__SO_PROBE__
How LinkedIn fingerprints your browser while you use __SO_NAME__
Even after a cookie is copied out, LinkedIn keeps one more receipt on every request that follows β a 48-point snapshot of the exact machine making it. Faking it convincingly means reproducing that machine's quirks, not just editing a string.
Click any signal above for what it means. These are illustrative values β this demo never reads your actual device.
Canvas render hash: Draws a hidden shape and hashes the pixels β GPU/driver quirks make it near-unique. (illustrative β e.g. a1f9β¦3e0c)
WebGL parameters: 65+ GPU/renderer values read straight from the graphics driver. (illustrative β e.g. ANGLE (Apple, M2 Pro))
AudioContext: Plays an inaudible tone and hashes tiny hardware-specific waveform differences. (illustrative β e.g. 124.0432β¦)
Installed fonts: Measures text rendering to infer which fonts are installed on your machine. (illustrative β e.g. 38 fonts)
Local IP (WebRTC): A WebRTC leak reveals your real local network IP, even behind a VPN. (illustrative β e.g. 192.168.1.x)
Timezone Γ2: Checked two different ways β a mismatch between them is itself a signal. (illustrative β e.g. Europe/Warsaw)
Hardware & OS: CPU core count, device memory, screen size/depth, platform string. (illustrative β e.g. 8 cores Β· macOS)
navigator.webdriver: Chrome's own automation flag β true when a page is driven by Selenium/Puppeteer. (illustrative β e.g. false)
Cameras & mics: Enumerates connected media devices without asking permission to use them. (illustrative β e.g. 1 camera Β· 2 mics)
Incognito flag: A filesystem-quota heuristic that detects private-browsing mode. (illustrative β e.g. false)
This extension runs inside your real browser, so its requests always carry your real fingerprint β that isn't something it controls, it's simply where its code executes.
Is __SO_NAME__ safe on LinkedIn in 2026?
Not right now β LinkedIn dropped __SO_NAME__ from its detection list (we checked it ). __SO_NAME__ was on LinkedIn's AED list in the Feb 2026 capture but isn't on the current one (Nov 2026 snapshot) β LinkedIn rotates the list, so __SO_NAME__ can be added back at any time, and page scans and device fingerprinting still apply.
Does LinkedIn detect __SO_NAME__?
This extension's ID was in LinkedIn's AED detection list in the Feb 2026 capture, but LinkedIn removed it by the Nov 2026 snapshot. LinkedIn rotates this list β between those two captures it dropped 2,544 extensions and added 1,325 β so a dropped ID can come back.
Not a clean bill of health. AED is only one of LinkedIn's detection systems: page scans for injected code and device fingerprinting need no list at all. See how it works β
How LinkedIn fingerprints your browser while you use __SO_NAME__
Even after a cookie is copied out, LinkedIn keeps one more receipt on every request that follows β a 48-point snapshot of the exact machine making it. Faking it convincingly means reproducing that machine's quirks, not just editing a string.
Click any signal above for what it means. These are illustrative values β this demo never reads your actual device.
Canvas render hash: Draws a hidden shape and hashes the pixels β GPU/driver quirks make it near-unique. (illustrative β e.g. a1f9β¦3e0c)
WebGL parameters: 65+ GPU/renderer values read straight from the graphics driver. (illustrative β e.g. ANGLE (Apple, M2 Pro))
AudioContext: Plays an inaudible tone and hashes tiny hardware-specific waveform differences. (illustrative β e.g. 124.0432β¦)
Installed fonts: Measures text rendering to infer which fonts are installed on your machine. (illustrative β e.g. 38 fonts)
Local IP (WebRTC): A WebRTC leak reveals your real local network IP, even behind a VPN. (illustrative β e.g. 192.168.1.x)
Timezone Γ2: Checked two different ways β a mismatch between them is itself a signal. (illustrative β e.g. Europe/Warsaw)
Hardware & OS: CPU core count, device memory, screen size/depth, platform string. (illustrative β e.g. 8 cores Β· macOS)
navigator.webdriver: Chrome's own automation flag β true when a page is driven by Selenium/Puppeteer. (illustrative β e.g. false)
Cameras & mics: Enumerates connected media devices without asking permission to use them. (illustrative β e.g. 1 camera Β· 2 mics)
Incognito flag: A filesystem-quota heuristic that detects private-browsing mode. (illustrative β e.g. false)
This extension runs inside your real browser, so its requests always carry your real fingerprint β that isn't something it controls, it's simply where its code executes.
Is __SO_NAME__ safe on LinkedIn in 2026?
__SO_NAME__ isn't on LinkedIn's AED detection list (we checked it ) (Nov 2026 snapshot) β but that is not a clean bill of health for __SO_NAME__: LinkedIn also scans the page for injected code and fingerprints your device, and neither needs a list.
Does LinkedIn detect __SO_NAME__?
This Extension ID isn't in LinkedIn's active extension-detection (AED) list as of the Nov 2026 snapshot.
This is not a clean bill of health. AED is only one of LinkedIn's three detection systems: a second (Spectroscopy) scans the page for any extension's traces with no list at all, a third fingerprints your device β and a behavioral layer watches what you do. Tools we've torn down (e.g. Expandi, HeyReach) aren't on this list yet still upload your session. See how it works β
How LinkedIn fingerprints your browser while you use __SO_NAME__
Even after a cookie is copied out, LinkedIn keeps one more receipt on every request that follows β a 48-point snapshot of the exact machine making it. Faking it convincingly means reproducing that machine's quirks, not just editing a string.
Click any signal above for what it means. These are illustrative values β this demo never reads your actual device.
Canvas render hash: Draws a hidden shape and hashes the pixels β GPU/driver quirks make it near-unique. (illustrative β e.g. a1f9β¦3e0c)
WebGL parameters: 65+ GPU/renderer values read straight from the graphics driver. (illustrative β e.g. ANGLE (Apple, M2 Pro))
AudioContext: Plays an inaudible tone and hashes tiny hardware-specific waveform differences. (illustrative β e.g. 124.0432β¦)
Installed fonts: Measures text rendering to infer which fonts are installed on your machine. (illustrative β e.g. 38 fonts)
Local IP (WebRTC): A WebRTC leak reveals your real local network IP, even behind a VPN. (illustrative β e.g. 192.168.1.x)
Timezone Γ2: Checked two different ways β a mismatch between them is itself a signal. (illustrative β e.g. Europe/Warsaw)
Hardware & OS: CPU core count, device memory, screen size/depth, platform string. (illustrative β e.g. 8 cores Β· macOS)
navigator.webdriver: Chrome's own automation flag β true when a page is driven by Selenium/Puppeteer. (illustrative β e.g. false)
Cameras & mics: Enumerates connected media devices without asking permission to use them. (illustrative β e.g. 1 camera Β· 2 mics)
Incognito flag: A filesystem-quota heuristic that detects private-browsing mode. (illustrative β e.g. false)
This extension runs inside your real browser, so its requests always carry your real fingerprint β that isn't something it controls, it's simply where its code executes.
Extensions matchingβ__SO_QUERY__β(__SO_COUNT__ found)
No extensions detected in dataset
We crawled LinkedIn's compiled endpoints as of Nov 2026 and couldn't locate any active fingerprints matching "__SO_QUERY__".
Back to all queries__SO_NAME__
ID: __SO_ID__