Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found
A popular Chrome and Edge header-editing extension, ModHeader, was found to contain a hidden browsing history collector, despite claims it didn't collect data. Researchers at Stripe OLT discovered the collector was dormant due to an empty allow-list, but a routine update populated this list, enabling the data collection. The extension was pulled from both the Chrome Web Store and Edge Addons store. While initially rated as low risk by automated scanners, the design highlights a significant vulnerability in extension review processes – the potential for dormant code to be activated by seemingly innocuous updates.
A popular Chrome and Edge header-editing extension, ModHeader, has been removed from the Web Store and Edge Addons store after researchers at Stripe OLT discovered a hidden browsing history collector embedded within the application. Despite claims that ModHeader did not collect user data, the researchers found that a routine update populated an empty allow-list, effectively activating the collector. The extension, which was initially rated as low risk by automated scanners, quietly collected full HTTP headers and stored them locally, before periodically uploading them to a repurposed domain, stanfordstudies[.]com, which is linked to an OpenSearch back end. The upload process was gated by an empty allow-list, preventing scanners from detecting the data transmission.
Further investigation revealed that the extension also pinged extensions-hub[.]com, a domain used for advertising, and logged real request metadata to local storage in plain text. The researchers linked the domains to a Chinese-speaking operator, citing a Simplified Chinese locale, a “salt” marker written with the character 盐, and a China-origin mail provider. ModHeader's own website still publishes an ad plan that states it collects no user data, despite the presence of the collector.
Brian Krebs previously described how popular extensions are often quietly bought and turned into data pipes. This incident highlights a critical weakness in the current extension review process – the potential for dormant code to be activated by seemingly routine updates. The design demonstrates a complete, store-verified collector hidden within a trusted tool, one that could be easily replicated in future extensions.
**What to do:** If you have ModHeader installed, remove it from Chrome and Edge; your browser may have disabled it already. Uninstalling clears its stored data, so double-check that profile sync or a managed extension policy won't reinstall it. If you pasted secrets into it, API keys, bearer tokens, and session cookies, rotate them, since researchers found its header-history feature storing full HTTP headers on disk. For defenders, block and log stanfordstudies[.]com and extensions-hub[.]com at DNS and proxy, and search logs for the extension ID and any POST to api.stanfordstudies[.]com/app/log. Stripe OLT published ready-to-run KQL hunting queries for Defender and Sentinel.