Google and Microsoft Remove ModHeader After Finding Dormant Data Collector
Popular browser extension with 1.6M users found to contain hidden browsing history collector.
1Hidden Threat in Extension
ModHeader, a popular browser extension, was found to contain a hidden system capable of collecting users' browsing history. Google and Microsoft removed the extension from their stores on July 10 and July 3 respectively. The extension had approximately 1.6 million users across Chrome and Edge browsers.
2How It Worked
Analysis revealed the extension was programmed to encrypt and store visited domains locally, then bundle and send them daily to an external server. However, an empty allow-list kept this feature inactive. A routine update could have easily populated this list and activated the data collection.
3Design That Evaded Security Checks
The extension was designed to appear low-risk to automated security scanners. Encrypted data showed as gibberish, the disabled upload feature meant nothing left sandbox environments, and malicious code was hidden within legitimate code. The extension maintained high trust scores despite its hidden capability.
4Previous Suspicious Activity
ModHeader had drawn complaints in 2023 for injecting ads into search results. Researchers suspect ownership changed when it shifted to an ad-supported model. Ironically, its official website still claims it 'collects no user data' - directly contradicting the built-in collection system found in its code.
5User Action Required
Users should immediately remove ModHeader and verify their browsers haven't already disabled it. Those who entered sensitive information like API keys should rotate them. Network defenders should block stanfordstudies.com and extensions-hub.com domains and monitor for related network traffic.
6The Bigger Issue: Trust Model
This incident reveals how even store-verified popular extensions can't be fully trusted. Dormant malicious code that could activate via routine updates poses a significant threat to the extension ecosystem. Current security scans struggle to detect such sophisticated designs, requiring new approaches to extension vetting.