Chrome and Edge Yank ModHeader Extension After Hidden History Collector Found

Key points

• Google and Microsoft removed the ModHeader extension from the Chrome Web Store and the Edge Add-ons store after researchers found a hidden browsing-history collector inside the official version.
• The extension had roughly 1.6 million combined installs across Chrome and Edge.
• The collector was dormant, held back by an empty allow-list, and no proof has emerged that it ever gathered or sent any browsing data.
• Users should remove the extension and check which other add-ons can read their browsing activity.

Google and Microsoft have pulled a widely used browser add-on called ModHeader after security researchers spotted code built to log where users go on the web.

ModHeader is a developer tool that lets people alter the small pieces of information a browser sends to a website, useful for testing. About 1.6 million people had installed it across Chrome and Edge.

The hidden feature was a browsing-history collector: code that could record the domains a user visits and send that list elsewhere. On the store version, it was switched off, held back by an allow-list, a short register of sites it was permitted to watch, that was empty. Nothing was captured. Nothing was sent. The machinery was there, waiting.

Should users be worried?

Not about past data theft, based on what's been found so far. Researchers, whose findings were first reported by The Hacker News, say there's no evidence the collector ever ran against real users. The concern is that the code existed at all inside an extension trusted by more than a million people.

Browser extensions sit in a sensitive spot. Many ask for permission to read and change every page you visit, which is fine when the extension behaves. It becomes a serious problem the moment an extension updates or ships code that can be flipped on remotely. That's exactly the shape of the risk here: a single change to the allow-list on a remote server could have turned a dormant feature into an active tracker across a large user base. Neither store has said publicly whether the developer added the code deliberately, whether an account was hijacked, or whether a third-party library pulled it in. This fits a pattern we've been tracking since June: our coverage of 152 adware-laced wallpaper extensions and Microsoft's removal of 119 StegoAd extensions showed the same gap between what a store listing promises and what the code actually does.

What should ModHeader users do now?

Remove it. In Chrome, open Extensions under the three-dot menu and click Remove next to ModHeader. Edge uses the same path under the puzzle-piece icon. Both browsers will disable the extension once the listing is pulled, but manual removal is cleaner.

While you're there, audit your other extensions. Does each one still serve a purpose, and does it genuinely need permission to read data on every site you visit? Those are the two questions worth asking.

For businesses the lesson is sharper. Extensions on work machines can read internal portals, email interfaces and HR dashboards. Many IT teams don't keep a list of which add-ons are running on which laptops. A managed allow-list of approved extensions, pushed through browser policy, closes that gap.

Google and Microsoft haven't published a formal advisory linking the takedown to a specific policy clause, and neither store has issued a CVE. Researchers are still examining older versions to see whether the collector ever pointed at a live target.

The safest reading right now: a popular tool shipped with a loaded but unfired weapon inside it, and two of the biggest browser vendors decided that was reason enough to pull it. Whether the code got there by accident or design is still the open question.