# Google and Microsoft Remove ModHeader After Finding Dormant Data Collector Popular browser extension with 1.6M users found to contain hidden browsing history collector. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/8b1d7807-d516-4e66-954e-5b8708d986cf ## Hidden Threat in Extension ModHeader, a popular browser extension, was found to contain a hidden system capable of collecting users' browsing history. Google and Microsoft removed the extension from their stores on July 10 and July 3 respectively. The extension had approximately 1.6 million users across Chrome and Edge browsers. ## How It Worked Analysis revealed the extension was programmed to encrypt and store visited domains locally, then bundle and send them daily to an external server. However, an empty allow-list kept this feature inactive. A routine update could have easily populated this list and activated the data collection. ## Design That Evaded Security Checks The extension was designed to appear low-risk to automated security scanners. Encrypted data showed as gibberish, the disabled upload feature meant nothing left sandbox environments, and malicious code was hidden within legitimate code. The extension maintained high trust scores despite its hidden capability. ## Previous Suspicious Activity ModHeader had drawn complaints in 2023 for injecting ads into search results. Researchers suspect ownership changed when it shifted to an ad-supported model. Ironically, its official website still claims it 'collects no user data' - directly contradicting the built-in collection system found in its code. ## User Action Required Users should immediately remove ModHeader and verify their browsers haven't already disabled it. Those who entered sensitive information like API keys should rotate them. Network defenders should block stanfordstudies.com and extensions-hub.com domains and monitor for related network traffic. ## The Bigger Issue: Trust Model This incident reveals how even store-verified popular extensions can't be fully trusted. Dormant malicious code that could activate via routine updates poses a significant threat to the extension ecosystem. Current security scans struggle to detect such sophisticated designs, requiring new approaches to extension vetting. ## Sources covering this story - https://thehackernews.com/2026/07/google-and-microsoft-pull-modheader.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._