Detecting browser extensions for bot detection, lessons from LinkedIn and Castle

Modern bot detection rarely deals with obviously fake browsers. Most large-scale automation today runs inside browser instances, with patched fingerprints, realistic behavior, and few visible automation artifacts. This pushes detection systems toward weaker, contextual signals rather than single hard indicators. Browser extensions are one such signal. Extensions run in separate execution contexts, but they are not always fully isolated from the page. Many can inject scripts or styles, modify the DOM, expose global objects, or make internal resources accessible to websites. These interactions often leave observable side effects. At the same time, extensions are commonly used in automation stacks. Scrapers, CAPTCHA solvers, and workflow automation tools frequently rely on extensions to simplify or scale abuse. Even when an extension is not actively used on a given site, its presence can still reveal information about the environment. Thus, detecting browser extensions provide valuable context when it comes to fraud and bot detection. In this article, we explain how to detect browser extensions using client-side JavaScript. We start from a real world example and analyze how LinkedIn detects browser extensions. We discuss why this technique works and where its limitations lie. We then contrast it with the stealthier approach used at Castle
Read More