 |
| This image was generated by AI. |
Google and Microsoft have officially yanked the popular developer extension ModHeader from their respective web stores. The sudden removal comes after cybersecurity researchers discovered a hidden browsing-history collector embedded directly within the tool’s official build.
Before its removal, the extension boasted an estimated 1.6 million installations across Chrome and Edge. This security breach serves as a stark reminder of how vulnerable browser extensions can be to supply chain attacks.
Shipped Inside the Genuine Build
The alarming discovery was uncovered by UK-based security firm Stripe OLT during a routine incident response. Crucially, the researchers verified the code against Google’s official Web Store signature.
This verification proves that the tracking mechanism was not part of a counterfeit clone. Instead, it shipped directly inside the genuine, verified version (7.0.18) distributed to unsuspecting users. As security experts note, a digital store signature only guarantees where a file originated—never what it actually does.
Anatomy of a Dormant Surveillance Pipeline
While the analysis revealed a fully built data collection framework, researchers found that the mechanism was technically dormant. The history collection function was gated by an empty "allow-list" variable, meaning no active data exfiltration was observed leaving the extension during the analysis.
However, the architecture was entirely complete and functional, containing:
Device Fingerprinting: The code generates a stable, unique identifier for each machine upon installation.
Encrypted Logging: Visited domains are extracted and immediately encrypted locally using a hardcoded AES-GCM key.
Scheduled Exfiltration: A built-in scheduler was ready to POST the encrypted history to an external backend domain (
api.stanfordstudies.com) roughly once per day.Live Telemetry: While history logging was gated, the extension did actively send installation, update, and uninstallation metrics to a known advertising network (
extensions-hub.com).
Because the entire infrastructure was already in place, a simple background update could have populated the empty allow-list. This would have silently activated full-scale browsing data theft without requiring any new user permissions.
How the Code Defeated Automated App Store Scanners
Many users wonder how an extension with a safety rating as high as 95 out of 100 bypassed automated defense systems. The architecture reads like a direct checklist for evading modern security sandboxes:
Ciphertext Storage: Because the collected data is immediately encrypted, automated scanners see harmless blocks of text rather than recognizable URLs.
Gated Triggers: Because the upload function remains switched off by default, dynamic sandboxes do not observe any suspicious outbound web traffic.
Blended Base: The malicious code is heavily minified and deliberately woven into legitimate dependencies and local database libraries.
Urgent Action Required: How to Protect Your System
If you currently have ModHeader installed for web development or QA testing, you must manually remove it from your browser immediately. > Important Note: When Google or Microsoft removes an extension from their official stores, it only blocks new installations. It does not automatically delete the extension from local machines where it is already running.
Because header editors require expansive host permissions (<all_urls>) to function properly, a compromised extension poses a massive risk to corporate networks. Security teams are strongly advised to audit their fleets for the extension ID idgpnmonknjnojddfkpgkljpfnnfcklj and block outbound traffic to the associated domains. Moving forward, organizations should consider adopting a strict "deny-by-default" policy for high-permission extensions.