ModHeader Extension Removed After Hidden Browsing-History Collector Discovered
Uninstall ModHeader from all browsers and replace with a trusted alternative.
Uninstall ModHeader from all corporate devices, audit browser extensions, and enforce a whitelist policy.
Summary
ModHeader, a popular header‑editing extension with roughly 1.6 million installs on Chrome and Edge, was pulled from the official stores after researchers uncovered a hidden browsing‑history collector embedded in its code. The collector was dormant, kept off by an empty allow‑list, and there is no evidence it ever transmitted any browsing data. Despite its inactivity, the presence of such a collector raised serious privacy concerns, prompting the removal of the extension from both Chrome Web Store and Microsoft Edge Add‑ons. Users who relied on ModHeader are advised to uninstall it and seek a trusted alternative. The incident highlights the importance of vetting third‑party extensions and monitoring for hidden payloads. Microsoft and Google have issued statements urging developers to adhere to strict privacy guidelines. The removal serves as a reminder that even widely used tools can harbor undisclosed functionality.
Key changes
- ModHeader removed from Chrome and Edge stores
- Hidden browsing‑history collector discovered
- Collector dormant, controlled by empty allow‑list
- No evidence of data exfiltration
- Users advised to uninstall and replace
- Incident underscores need for extension vetting