Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
After researchers discovered a hidden browsing-history collector in ModHeader's official store version, Google and Microsoft removed the popular header-editing extension, which has about 1.6 million installs across Chrome and Edge.
The collector was inactive. It was kept off by an empty allow-list, and there is no evidence that it ever collected or transmitted a single surfing domain.
The analysis was provided by the UK security company Stripe OLT, which verified the collector shipped the authentic extension rather than a fake by comparing the code to Google's own Web Store signature.
Its review includes the Chrome build and its approximately 900,000 users; third-party trackers place an additional 700,000 on Edge. Google withdrew the Chrome listing on July 10, one week after Micr...