Google Follows Microsoft to Remove ModHeader Extension from Store Following Reports of Covert Exfiltration Capability

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

Google and Microsoft have removed ModHeader, a widely used developer tool for editing HTTP headers, after security researchers discovered a dormant data-collection mechanism built directly into its genuine, signed store version. ModHeader had amassed approximately 1.6 million installs across the two browsers before its takedown.

Hidden Collector Found Inside the Official Build

The discovery came from Stripe OLT, a U.K.-based security firm, which verified the code against Google's own Web Store signature and confirmed the collector shipped inside the authentic extension rather than a counterfeit copy. 

The report was updated on July 13 with Google’s announcement that it pulled the Chrome listing on July 10, a week after Microsoft removed the Edge listing on July 3, 2026. 

The collector itself was inactive: an empty allow-list kept it switched off, and no evidence has surfaced that it ever gathered or transmitted browsing data. 

However, the underlying pipeline, including the endpoint, encryption key, scheduler, storage, and collection logic, was fully built and could have been activated through a routine extension update. A future “update” could have activated it without any new permissions or user interaction.

What the Extension Was Actually Doing

Separately, researchers found the extension was logging product, version identifier, and browser type, and pinging an external domain with product and version details each time it was installed, updated, or uninstalled. 

Because ModHeader is designed to give broad access to a browser's traffic for legitimate testing and debugging purposes, that same access made it a high-value target once trust in the codebase was compromised.

Some sources allege the extension uses a fake "Stanford Studies" front for the exfiltration domain, and weak signals point to a Chinese-speaking operator.

Marketplace Response and Ongoing Exposure

Removing ModHeader from both the Chrome Web Store and the Microsoft Edge Add-ons store prevents new installs but does not delete the extension from devices where it's already installed. 

Affected users are advised to manually check their Chrome and Edge extensions list and remove ModHeader if it remains active.

The report also notes that the infrastructure here, which debuted in 2024, shares several characteristics with the pattern Brian Krebs described in a 2021 report on popular browser extensions quietly bought” and repurposed into monetization and surveillance channels.

In late June, Microsoft removed 100+ StegoAd Edge extensions hiding malware via steganography.

Related

EU, UK Sanction VKontakte Over FSB-Linked MaxApp Surveillance Tool, Lumma Stealer Operators, GRU Members

Apple Accuses Ex-Engineer of Exploiting ‘Rare’ Zero-Day to Steal Trade Secrets for OpenAI

Nihon Kotsu Confirms Malware Infection, Taxi Dispatch Systems Disrupted

Supply Chain Attack: jscrambler npm Package Compromised, Targeting Wallets, AI Tools, Cloud Credentials

Weekly Cybersecurity Roundup: Tracking Cybercrime Across Corporate Systems, Trusted Insiders, and Vulnerable Victims

UK Regulator Ofcom Targets Scam Ads With Tough New Rules for Big Tech

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.

Subscribe for Free

Please enter a valid email address.

Most Popular

EU, UK Sanction VKontakte Over FSB-Linked MaxApp Surveillance Tool, Lumma Stealer Operators, GRU Members

Apple Accuses Ex-Engineer of Exploiting ‘Rare’ Zero-Day to Steal Trade Secrets for OpenAI

US Sanctions VPN Provider 1VPNS Over Alleged Role in Supporting Hospital Ransomware Attacks

The Decision Burden Behind SOC Alert Fatigue and How Experts Would Reduce It 

Nihon Kotsu Confirms Malware Infection, Taxi Dispatch Systems Disrupted

Supply Chain Attack: jscrambler npm Package Compromised, Targeting Wallets, AI Tools, Cloud Credentials

EU, UK Sanction VKontakte Over FSB-Linked MaxApp Surveillance Tool, Lumma Stealer Operators, GRU Members

Apple Accuses Ex-Engineer of Exploiting ‘Rare’ Zero-Day to Steal Trade Secrets for OpenAI

US Sanctions VPN Provider 1VPNS Over Alleged Role in Supporting Hospital Ransomware Attacks

The Decision Burden Behind SOC Alert Fatigue and How Experts Would Reduce It 

Nihon Kotsu Confirms Malware Infection, Taxi Dispatch Systems Disrupted

Supply Chain Attack: jscrambler npm Package Compromised, Targeting Wallets, AI Tools, Cloud Credentials