ModHeader Hid a Browsing Collector From 1.6M Users

The extension was signed by Google. It sat in the official Chrome Web Store with roughly 900,000 users, and automated reputation services graded it as high as 95 out of 100 for safety with no malware flagged. Buried in the minified bundle, dressed up as a date formatting library, sat a complete browsing history collection pipeline: encryption, local storage, a device fingerprint, an upload scheduler aimed at an external endpoint. Fully built. Waiting on one empty list to switch it on.

Key Takeaways

• ModHeader version 7.0.18, installed by roughly 900,000 Chrome users and 700,000 Edge users, shipped a fully built but dormant browsing history collector inside the genuine store build.
• UK security firm Stripe OLT matched the code against Google's own Web Store signature, confirming the collector rode inside the authentic signed extension rather than a counterfeit clone.
• The collector encrypted visited domains with a hardcoded AES-GCM key, held up to 1,000 of them in an IndexedDB database named "temp," and staged a daily upload to api.stanfordstudies[.]com.
• An empty allow list kept the collector switched off, and researchers found no evidence that a single browsing domain ever left a test profile.
• Microsoft pulled ModHeader from the Edge store on July 3, 2026, Google removed it from Chrome on July 10, and the research went public on July 13.

What Is ModHeader, and Why Did 1.6 Million People Install It?

ModHeader is a browser utility that lets you add, modify, or strip HTTP request and response headers on the fly, and it became standard equipment for web developers, QA engineers, and penetration testers.

Testing an authorization flow means forging an Authorization header. Reproducing a customer bug means pinning the cookie they had. ModHeader made that a two click job instead of a curl command, which is why it spread through engineering teams by word of mouth.

Sit with who that audience is. Not a coupon finder aimed at people who click whatever the browser suggests: the population running ModHeader reads changelogs and knows what a manifest file is. The reported install split was about 900,000 on Chrome and 700,000 on Edge. Sophistication did not help any of them, because there was nothing visible to be sophisticated about.

What Did Researchers Find Inside ModHeader?

A complete, functional browsing history exfiltration pipeline that was gated off rather than removed. Stripe OLT analyzed version 7.0.18 on July 6, 2026, while the extension was still live and installable, and documented every stage of it.

The mechanics, per the technical breakdown published by GBHackers:

• Domain extraction. A tab update handler pulled the domain out of every URL you visited.
• Encryption. Domains were encrypted with AES-GCM using a key hardcoded into the bundle, so nothing readable ever sat on disk.
• Local staging. An IndexedDB database named temp held up to 1,000 encrypted domain records with visit counts; a second store kept the device fingerprint, the initialization vector, and scheduler state.
• Device identity. A fingerprint was generated on first run, giving the operator a stable handle for every install.
• Scheduled upload. A daily job posted the encrypted list plus the fingerprint to api.stanfordstudies[.]com/app/log, with the timing offset per installation so uploads would not arrive in a detectable wave.
• Separate beacon. A second channel pinged extensions-hub[.]com on install, update, and uninstall, reporting product, version, and browser. Both domains resolved to the same Amazon host.

One thing stopped all of it: the allow list shipped empty, so the tab update handler exited before it collected anything. No stolen browsing history has been demonstrated. That is the honest reading, and it is the reason this story deserves more attention rather than less.

Why Wouldn't Chrome Have Warned You?

Because ModHeader already held every permission the collector needed, and Chrome only interrupts you when an update asks for something new.

Google's own permission warning guidelines state the rule plainly: "When a new permission that triggers a warning is added, the extension will be disabled until the user accepts the new permission." Read the inverse and you have the whole problem. No new permission means no disable, no prompt, no signal of any kind.

ModHeader requested <all_urls>, webRequest, storage, alarms, and content script injection. Every one is defensible for a header editor: you cannot rewrite headers on arbitrary sites without access to arbitrary sites. That is also, exactly, the permission set a browsing history collector wants, so no reviewer reading the manifest sees anything out of place.

This is why "dormant" is the wrong word to relax about. Flipping the switch meant populating a list, shipping a routine version bump, and letting auto update do the rest. No prompt would fire. The distance between the code found and the code firing was one release.

How Did It Pass Every Automated Check?

Each layer of the design happened to defeat a different kind of scanner, and the store's own trust signals did the rest.

Stripe OLT found that third party reputation services rated ModHeader low risk, some scoring it 95 out of 100 with no malware flagged. Work through why. The collected data was encrypted, so static analysis saw ciphertext instead of domains. The upload was gated behind an empty list, so a sandbox watched a clean profile and observed nothing leave. The code was minified into a legitimate bundle and disguised as a date library, so it read as vendor dependency noise. The endpoints were unremarkable domains with no malicious history to match against. And the package was signed, popular, and years old, which every reputation heuristic treats as evidence of good standing.

The trust chain did not partially fail here. It inverted. Age, install count, and a valid Google signature are the exact properties that made this build look safest, and Stripe OLT's most important move was matching the hashes against Google's Web Store signature to prove the collector shipped in the authentic extension. Ruling out a counterfeit is usually the reassuring finding. Here it was the alarming one.

Treat store badges accordingly. A "Featured" or verified marker reflects design review and policy compliance, not a line by line audit of every future release, which is the same lesson behind the 82 Chrome extensions that legally sell your browsing data while staying fully compliant with store policy.

Why Does the Removal Timeline Matter?

Because Chrome users kept installing a flagged extension for a week after Edge users stopped.

Microsoft removed the Edge listing on July 3, 2026. Google removed the Chrome listing on July 10 and later flagged it as malware, and TechRadar reported the researchers had prompted both takedowns. Stripe OLT published on July 13. In the seven day gap between the two takedowns, the larger user base, roughly 900,000 people, could still find and install version 7.0.18 from the official Chrome Web Store with nothing on the page suggesting a problem.

Delisting also does not uninstall anything. It stops new installs and cuts off future updates; the copy already sitting in your profile keeps running exactly as before. Anyone who installed ModHeader and forgot about it still has it.

The Update Attack Model Is the Real Story

A clean extension today can ship a collector tomorrow to everyone with auto update enabled, which is effectively everyone.

ModHeader is the loudest example, not an isolated one. Koi Security documented 18 Chrome and Edge extensions with more than 2 million combined installs that were published clean and later updated with tracking and backdoor code, in some cases years after release, installing automatically with no user input. In April 2026, researchers flagged 108 malicious Chrome extensions stealing Google OAuth tokens and hijacking Telegram sessions. And a counterfeit Perplexity extension was caught intercepting user searches earlier this month.

Now put the numbers side by side. That 108 extension campaign, which generated a week of headlines, reached about 20,000 installs. ModHeader alone reached 1.6 million: eighty times the exposure of the coordinated operation, from one extension nobody suspected. The scary campaigns are not the ones with obvious malware and tiny footprints. They are the ones with impeccable reputations.

The same logic applies one layer down, to the third party scripts websites load on your behalf. Days after ModHeader was pulled, adtech firm Adform's tracking script was hijacked to steal cryptocurrency from every site that embedded it — and no antivirus engine flagged it.

What This Means for Your Inbox

An extension holding <all_urls> plus content script injection is not restricted to the sites it advertises. It has the same reach into mail.google.com as it does into a staging server, and the browser draws no distinction between the two.

To be precise about what was found: the collector gathered domains, not message content, and nobody has shown it read anyone's email. But the permission ceiling sat far above what the discovered code used, and that gap is the point. A domain list from a developer's browser is not a shopping history. It maps internal admin panels, staging hostnames, CI dashboards, and vendor portals, tied to a stable device fingerprint. For anyone planning a phishing campaign against that organization, it is reconnaissance you cannot buy.

Here is the part that would be easy to skip. This is a fair reason to interrogate every extension in your browser, privacy extensions included. Anything running inside Gmail should be able to tell you what it touches and why it needs each permission it holds, and you should expect a straight answer rather than a badge. Comparing options on that basis is what our roundup of anti tracking browser extensions is for. Skepticism that only points at other people's tools is not skepticism.

Google's answer to cases like this arrived weeks later: a revised Limited Use policy, enforced from August 1, 2026, that confines any extension to collecting only what its disclosed single purpose requires. We looked at whether it actually reaches the email tracker extensions that surveil recipients.

What Should You Do Right Now?

Five concrete steps, in order of how much they buy you:

• Remove ModHeader. Open chrome://extensions, find ModHeader, click Remove. If it was on a work machine, tell your security team.
• Audit the rest of the list. Same page, click Details and read "Site access." Anything set to "On all sites" can read and modify every page you load, Gmail included. Extensions you have not opened in six months are standing risk; remove them.
• Tighten site access. Switch an extension from "On all sites" to "On click" and it runs only when you invoke it. Most tools survive this fine, and it shrinks the blast radius of a bad update to the moments you actually asked for.
• Read permissions before installing, not after. The Chrome Web Store lists requested permissions on the listing page. A tool that edits one site asking for every site is a question worth answering before clicking Add.
• Prefer open source and minimally permissioned tools. Public source does not guarantee a clean build, since what ships to the store is compiled and minified. It does mean someone other than the vendor can look.

Worth knowing that the extension platform itself is shifting underneath all of this. Manifest V2 is gone in Chrome 151, and what that removal did to uBlock Origin is a reminder that your installed set will keep churning whether or not you are watching.

The Bottom Line

Nobody's browsing history is known to have been stolen, and that is what makes the ModHeader case useful. Strip out the breach and you are left looking at the machinery, and the machinery worked. A signed, popular, years old extension carried a complete collection pipeline through the official store, past scanners that scored it 95 out of 100, into 1.6 million browsers. The only thing between that code and 1.6 million domain lists was an empty array and a version bump nobody had shipped yet. Open chrome://extensions and read the site access column. It takes four minutes and you will not like what you find.

Sources: The Hacker News, Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found, GBHackers, ModHeader Chrome Extension Exposes 900,000 Users to Potential Browsing History Theft, Cyber Press, ModHeader Chrome Extension Exposes 900,000 Users to Hidden Data Exfiltration Risk, Google, Permission warning guidelines for Chrome Extensions, Infosecurity Magazine, 18 Malicious Chrome and Edge Extensions Disguise as Everyday Tools, and The Hacker News, 108 Malicious Chrome Extensions Steal Google and Telegram Data.