Browser extensions leave detectable traces that can serve as signals for bot detection systems. LinkedIn probes chrome-extension:// URLs to detect installed extensions by attempting to fetch web-accessible resources, but this creates console noise and performance overhead. Castle uses a stealthier approach by observing DOM mutations, custom elements, and JavaScript globals that extensions inject into pages. While neither method can enumerate all extensions, both provide valuable contextual signals when combined with other fingerprinting techniques. The side-effect approach trades detection breadth for reduced observability and better performance.
Table of contents
Quick introduction to browser extensionsWhy extensions cannot be enumerated like pluginsA real-world example: LinkedIn’s extension detectionTradeoffs of chrome-extension resource probingA stealthier approach: extension detection at CastleConclusion: extension detection as contextual signal550 Impressions