techend
By Web Desk :
Security researchers urge users to uninstall browser extension used by more than 1.6 million people
Google and Microsoft have removed the popular ModHeader browser extension from their official extension stores after security researchers discovered hidden code capable of collecting users’ browsing history.
The extension, widely used by web developers to modify HTTP headers for testing and debugging, had an estimated 1.6 million installations across Google Chrome and Microsoft Edge before its removal.
Hidden code found in official extension
The discovery was made by UK-based cybersecurity firm Stripe OLT, which analysed the official version of the extension and confirmed that the suspicious code was present in the signed build distributed through the Chrome Web Store.
Researchers said the finding is particularly concerning because the extension was authentic—not a fake copy or malicious clone—and had passed the platforms’ verification process.
They noted that a digital signature confirms where software originated but does not guarantee that its internal code is free from potentially harmful functionality.
Data collection system remained inactive
According to the analysis, the browsing-history collection feature was not actively transmitting user data at the time of discovery.
The functionality remained dormant because it relied on an empty allow-list, preventing the collection mechanism from being activated.
However, researchers found that the underlying infrastructure had already been built, including:
- Data collection logic
- Encryption mechanisms
- Upload scheduling
- Communication endpoints
Security experts warned that a future update could potentially activate the feature without requiring additional permissions or user interaction.
Difficult for automated security tools to detect
Researchers said the design of the hidden functionality made it challenging for automated security scanners to identify.
The collected information was intended to be encrypted before transmission, while the upload process remained disabled unless activated, allowing the extension to appear harmless during routine security analysis.
As a result, several automated scanning services reportedly rated the extension as low risk despite the presence of the hidden code.
Additional allegations under investigation
The researchers found that the extension communicated with an external server during installation, updates and removal.
Some independent security analysts have claimed the extension may have transmitted data to infrastructure linked to a Chinese-speaking operator.
However, Stripe OLT’s published analysis did not confirm those allegations, stating only that the data collection capability existed within the extension.
At the time of publication, no verified evidence had emerged showing that users’ browsing histories were actually exfiltrated.
Privacy concerns raised
Researchers also questioned the extension’s published privacy policy, which reportedly states that it does not collect user data.
They argued that the presence of a built-in browsing-history collection mechanism appears inconsistent with those claims, even if the functionality remained disabled.
The developer of ModHeader had not publicly responded to the findings at the time the extension was removed.
Users advised to uninstall immediately
Cybersecurity experts recommend that users manually uninstall ModHeader from Chrome and Edge if it is still installed.
Removing the extension from the official browser stores does not automatically delete existing installations from users’ devices.
Because ModHeader requires extensive browser permissions to modify network requests, researchers warn that any compromise of such extensions could expose sensitive browsing activity.
The incident also highlights growing concerns over browser extension security, with experts urging users and organisations to regularly review installed extensions, limit unnecessary permissions and remove tools that are no longer required.
About The Author
