Is Waalaxy safe on LinkedIn in 2026?

No — LinkedIn detects Waalaxy (we checked it November 11, 2026). Waalaxy's extension ID is on LinkedIn's AED detection list (Nov 2026 snapshot), and LinkedIn's page code checks for Waalaxy on every visit by requesting chrome-extension://hlkiignknimkfafapmgpbnbnmkajgljh/assets/16x16.png — a file that exists only if Waalaxy is installed.

Updated November 11, 2026 · LinkedIn AED snapshot Nov 2026

ID: hlkiignknimkfafapmgpbnbnmkajgljh

Does LinkedIn detect Waalaxy?

Detected by LinkedIn

This browser extension is actively compiled into LinkedIn's frontend detection lists. LinkedIn's scripts can detect when this is active on your browser.

LinkedIn requests: chrome-extension://hlkiignknimkfafapmgpbnbnmkajgljh/assets/16x16.png

DETECTED

What this means: detection isn't an instant ban — it's one input to LinkedIn's risk score. But it's a standing signal: it stacks with your behavior (volume, programmatic clicks) and device fingerprint, and this is just the AED list — one of LinkedIn's three detection systems (see how it works).

How LinkedIn checks for Waalaxy: the AED probe

That verdict isn't a guess. This is what LinkedIn's own page code does on every visit — simplified from its production bundle, which the BrowserGate investigation reverse-engineered line by line:

// LinkedIn's page bundle — simplified from BrowserGate's teardown

const hits = [];

for (const { id, file } of AED_LIST) // 4,934 ids incl. this one

try { await fetch("chrome-extension://" + id + "/" + file); hits.push(id); }

catch {} // not installed → silently swallowed

fireTrackingPayload("AedEvent", { browserExtensionIds: hits }); // → POST /li/track

// this extension is probed at:
// chrome-extension://hlkiignknimkfafapmgpbnbnmkajgljh/assets/16x16.png

On LinkedIn’s AED list

Yes

1 of 4,934 · snapshot Nov 2026

URL LinkedIn requests

chrome-extension://hlkiignknimkfafapmgpbnbnmkajgljh/assets/16x16.png

the extension's ID + a file bundled inside it

Store status

Live on the Web Store

Source

LinkedIn bundle

ℹVerify it yourself: on linkedin.com open DevTools → Sources and search the page bundle for hlkiignknimk… or AedEvent; or Network → filter li/track to watch the verdict ship. The scan runs even in Incognito. Below — the full code-level teardown.

Waalaxy — marketed on the Chrome Web Store, detected by LinkedIn — Vendor's own Chrome Web Store screenshot — this extension is on LinkedIn's detection list.

How LinkedIn fingerprints your browser while you use Waalaxy

Even after a cookie is copied out, LinkedIn keeps one more receipt on every request that follows — a 48-point snapshot of the exact machine making it. Faking it convincingly means reproducing that machine's quirks, not just editing a string.

Click any signal above for what it means. These are illustrative values — this demo never reads your actual device.

Your 48-point fingerprint — RSA-encrypted, attached to every API call in this session, not just login

This extension runs inside your real browser, so its requests always carry your real fingerprint — that isn't something it controls, it's simply where its code executes.

Verified against LinkedIn source-code, Nov 2026 snapshot.Read full study