Google and Microsoft Remove ModHeader Browser Extension Over Dormant Browsing History Collector

Google and Microsoft removed the ModHeader browser extension after discovering a dormant browsing-history collector in its code, which was inactive due to an empty allow-list but could have been activated through a routine update. The find highlights risks in browser extension ecosystems and the challenges of detecting hidden data collection mechanisms in trusted tools.

Google and Microsoft have pulled ModHeader, a popular header-editing extension with roughly 1.6 million installs across Chrome and Edge, after researchers found a hidden browsing-history collector built into its official store version.

The collector was dormant. An empty allow-list kept it switched off, and no proof has emerged that it ever gathered or sent a single browsing domain.

The

Read original article