--- title: "Is Email Search and Outreach by Sprouts safe on LinkedIn in 2026?" description: "Does LinkedIn detect Email Search and Outreach by Sprouts? It was fingerprinted, then pulled from the Chrome Web Store. Checked against LinkedIn's own 4,9…" url: https://safe-outreach.com/is-email-search-and-outreach-safe date_published: 2026-11-13T08:01:38.410Z date_modified: 2026-11-14T00:00:00.000Z publisher: Safe Outreach --- # Is this extension safe on LinkedIn in 2026? **Risky — LinkedIn fingerprinted this extension** (we checked it November 14, 2026), and this extension has since been removed from the Chrome Web Store (Nov 2026 snapshot). If an old copy of this extension is still installed, LinkedIn keeps detecting it on every visit. Our automated scan of this extension 3.18.15 found code that references LinkedIn's session cookie li\_at (3 matches in 1 files); whether this extension sends that cookie anywhere needs a manual dataflow review. Updated November 14, 2026 · LinkedIn AED snapshot Nov 2026 ID: kljfdjngbjfhkfbmcjamofaipcmkbdmb ## Does LinkedIn detect this extension? What we found in its code Fingerprinted & removed LinkedIn audited this extension and fingerprinted its files in its client code. Since then, the extension has been **removed or delisted from the Chrome Web Store** (either by Google for policy violations, or by the developers to avoid bans). Probed URL: **chrome-extension://kljfdjngbjfhkfbmcjamofaipcmkbdmb/src/sidebar/index.html** Vulnerable **Scanning risk:** If you currently have an old package of this extension active on your drive, LinkedIn continues to scan your browser using HTTP requests to its unique internal files. ### What our automated scan found in this extension's code We downloaded this extension version 3.18.15 from the Chrome Web Store on November 2, 2026 and searched its 67 code files for the patterns below. Each line shows the first place we found it. - this extension's code references `li_at` — LinkedIn's session cookie, the one that keeps you logged in. 3 matches in 1 file — first at assets/index.ts-39049d95.js:1. - this extension's code references `JSESSIONID` — LinkedIn's CSRF cookie, needed to call LinkedIn's internal API as you. 4 matches in 1 file — first at assets/index.ts-39049d95.js:1. - this extension's code calls paths of LinkedIn's internal Voyager API (`voyager/api`). 5 matches in 1 file — first at assets/index.ts-39049d95.js:1. - this extension uses the Chrome cookies API (`chrome.cookies`), which reads cookies of every site it has access to. 8 matches in 1 file — first at assets/index.ts-39049d95.js:1. - this extension reads or writes `document.cookie` inside pages. 5 matches in 2 files — first at assets/extension-on-installed-a218d901.js:3. - this extension creates synthetic clicks or keystrokes (`dispatchEvent` / `MouseEvent`) — LinkedIn can tell these from real input (`isTrusted=false`). 103 matches in 12 files — first at assets/cjs-ca8fc6cd.js:3. - this extension runs code built at runtime (`eval` / `new Function`). 4 matches in 2 files — first at assets/inboxsdk-910e249a.js:3194. - this extension makes its own network requests (`fetch` / XHR / WebSocket). 74 matches in 15 files — first at assets/compose-buttons-init.js-289517e8.js:1. - this extension's code mentions linkedin.com. 41 matches in 7 files — first at assets/index-bb8ce695.js:1. Permissions this extension asks for storage tabs system.display notifications webRequest webNavigation scripting cookies identity clipboardRead clipboardWrite sidePanel https://www.linkedin.com/\*/\* https://mail.google.com/\* https://contacts.google.com/\* https://api.reply.io/\* https://run.replyapp-stage.net/\* https://run.reply.io/\* https://run.dev.reply.io/\* https://qa.sprouts.ai/\* https://abm.sprouts.ai/\* **What this scan is — and isn't.** It is an automated static search of the shipped package, not a full teardown: a match means the pattern is in the code, not that this extension misuses it, and no match doesn't prove absence (minified or runtime-built code can hide it). We haven't traced where this extension sends data. [How we test](https://safe-outreach.com/how-we-test) ### How LinkedIn checks for this extension: the AED probe That verdict isn't a guess. This is what LinkedIn's own page code does on every visit — simplified from its production bundle, which the [BrowserGate investigation](https://browsergate.eu/how-it-works/) reverse-engineered line by line: // LinkedIn's page bundle — simplified from BrowserGate's teardown const hits = \[\]; for (const { id, file } of AED\_LIST) // 4,934 ids incl. this one try { await fetch("chrome-extension://" + id + "/" + file); hits.push(id); } catch {} // not installed → silently swallowed fireTrackingPayload("AedEvent", { browserExtensionIds: hits }); // → POST /li/track // this extension is probed at: // chrome-extension://kljfdjngbjfhkfbmcjamofaipcmkbdmb/src/sidebar/index.html On LinkedIn’s AED list Yes 1 of 4,934 · snapshot Nov 2026 URL LinkedIn requests chrome-extension://kljfdjngbjfhkfbmcjamofaipcmkbdmb/src/sidebar/index.html the extension's ID + a file bundled inside it Store status Flagged & removed Source LinkedIn bundle ℹ **Verify it yourself:** on linkedin.com open DevTools → Sources and search the page bundle for kljfdjngbjfh… or AedEvent; or Network → filter li/track to watch the verdict ship. The scan runs even in Incognito. Below — the full code-level teardown. ![this extension — marketed on the Chrome Web Store, detected by LinkedIn](https://storage.googleapis.com/linkedhelper-sot/checker/shots/kljfdjngbjfhkfbmcjamofaipcmkbdmb.webp) Vendor's own Chrome Web Store screenshot — this extension is on LinkedIn's detection list. ## How LinkedIn fingerprints your browser while you use this extension Even after a cookie is copied out, LinkedIn keeps one more receipt on every request that follows — a 48-point snapshot of the exact machine making it. Faking it convincingly means reproducing that machine's quirks, not just editing a string. Click any signal above for what it means. These are illustrative values — this demo never reads your actual device. Your 48-point fingerprint — RSA-encrypted, attached to every API call in this session, not just login This extension runs inside your real browser, so its requests always carry your real fingerprint — that isn't something it controls, it's simply where its code executes. Verified against LinkedIn source-code, Nov 2026 snapshot. [Read full study](https://safe-outreach.com/how-we-test) ## Similar LinkedIn tools we checked Same architecture and risk as this extension — each with its own code audit. - [Is XING Transfer to LinkedIn safe on LinkedIn? MEDIUM](https://safe-outreach.com/is-xing-transfer-to-linkedin-safe) - [Is Superpowers for LinkedIn safe on LinkedIn? MEDIUM](https://safe-outreach.com/is-superpowers-safe) - [Is HeyReach safe on LinkedIn? uploads session HIGH](https://safe-outreach.com/is-heyreach-safe) - [Is Spark Hire Recruit Sourcing for Chrome safe on LinkedIn? MEDIUM](https://safe-outreach.com/is-spark-hire-recruit-sourcing-safe) - [Is LinkedIn Job Applicants Exporter safe on LinkedIn? MEDIUM](https://safe-outreach.com/is-linkedin-job-applicants-exporter-safe) - [Is Devi safe on LinkedIn? MEDIUM](https://safe-outreach.com/is-devi-safe) [All extension checks](https://safe-outreach.com/deep-dives#all-checks) --- Source: https://safe-outreach.com/is-email-search-and-outreach-safe