Popular ModHeader dev extension pulled after hidden history collector found

Google and Microsoft removed ModHeader, a header-editing browser extension popular with developers, with about 1.6 million installs, after researchers at Stripe OLT found a hidden browsing-history collector inside the official, signed store version. The collector was dormant, gated off by an empty allow-list, and no evidence has emerged that it ever sent data, but its presence in a trusted, signed extension is the concern. Its design frustrated automated review: the data was encrypted, the upload was switched off so sandboxes saw nothing leave, and malicious code was blended into a legitimate codebase, so scanners rated it low risk. It is a reminder that a store signature proves origin, not safe behavior.

Check

Check whether ModHeader is installed on developer or tester machines, remove or update it per the vendors' guidance, and review which browser extensions have broad permissions across your organization.

Affected

Developers and testers who installed ModHeader, and their organizations; a trusted, signed extension shipped a dormant collector capable of recording visited domains, showing signed extensions can still hide unwanted behavior.

Fix

Govern browser extensions with allow-lists and permission reviews, do not treat a store signature as proof of safe behavior, prefer minimal necessary extensions, and monitor for extensions contacting unfamiliar external endpoints.