ModHeader pulled: 1.6M-user extension hid dormant spy kit

ModHeader, a header-editing extension used by about 1.6 million people across Chrome and Edge, has been pulled from both stores. Microsoft delisted it on 3 July. Google followed on 10 July. UK firm Stripe OLT found the reason: a fully built browsing-history collector sitting inside the officially signed code.

The odd part is that the collector was not running.

A spy kit with the switch left off

Version 7.0.18 does exactly what the marketing says. It edits HTTP headers. But the same background script also builds a device fingerprint, loads a hardcoded encryption key, and is wired up to grab the domain of every page you visit, encrypt it, batch up to a thousand of them, and post the lot to api.stanfordstudies[.]com once a day.

All of that machinery is gated behind a browser allow-list. The allow-list ships empty. The check fails every time. Nothing leaves the machine.

Populating that list is a one-line change, delivered as a routine update. No new permissions. No consent prompt. The key, the endpoint, the scheduler and the local storage are already on the user's computer, waiting.

Why the scanners missed it

Automated extension scanners rated ModHeader as low risk. Some scored it as high as 95 out of 100. The reasons stack up neatly:

• The payload is encrypted, so scanners see ciphertext.
• The upload is gated off, so sandboxes see nothing leave.
• The malicious logic is minified into a legitimate codebase.
• The domains had no bad reputation to flag.
• The whole thing carries a valid Chrome Web Store signature, which proves where a file came from, not what it intends to do.

Stripe OLT also noted that stanfordstudies[.]com has no connection to Stanford and fronts an OpenSearch backend. A second domain, extensions-hub[.]com, was pinged on install and uninstall with product and browser details.

A bit of history

ModHeader is not new to controversy. It raised eyebrows in 2023 for injecting ads into search results and reportedly going ad-supported around the same time. Current ownership is unclear, and the researchers stop short of naming a group.

What to do about it

If you have ModHeader installed, remove it from Chrome and Edge. Check that profile sync or a managed extension policy will not quietly reinstall it on next login.

If you ever pasted API keys, bearer tokens or session cookies into the extension while debugging, rotate them. The header-history feature was writing full HTTP headers to disk in plain text, which is a small treasure chest all by itself.

The bigger shift

For anyone reviewing browser extensions across a fleet, the useful question has changed. It is no longer whether an extension is doing something bad today. It is whether the next update can flip a switch and start.

That is a much harder review to automate. Signatures, permission diffs and reputation scores all miss it. What catches it is a person reading the code and asking why an ordinary header editor needs an encryption key, a scheduler and an endpoint list bolted on at all.