ModHeader Extension Removed From Chrome and Edge Stores

Google and Microsoft removed the ModHeader browser extension from their respective Chrome and Edge web stores on March 13, 2024, following the discovery of hidden code designed to collect user browsing history. The extension, which had accumulated approximately 1.6 million installations, contained a dormant data collector. This collector was inactive due to an empty allow-list, meaning it was never enabled to send any browsing data. Researchers from the security firm Ghost Security initially identified the malicious code.

While the collector was found to be dormant and no evidence suggests it actively gathered or transmitted browsing data, its presence raised significant privacy concerns. ModHeader is a tool that allows users to modify HTTP headers, often utilized by web developers for testing purposes. The discovery highlights the potential risks associated with third-party browser extensions, even those with a substantial user base and seemingly legitimate functionality.

Ghost Security reported that the code was embedded within the extension's files and was designed to capture browsing domains. The firm stated that the collector was "dormant" and "never activated" due to the empty allow-list configuration. This detail suggests that while the capability existed, it was not exploited. However, the mere inclusion of such code in an officially distributed extension is a serious security lapse.

Following the disclosure by Ghost Security, both Google and Microsoft acted swiftly to delist the extension. This action aims to protect the millions of users who had installed ModHeader from any potential future exploitation of the discovered vulnerability. The removal serves as a reminder for users to exercise caution when installing browser extensions and for platform providers to maintain rigorous security checks on their app stores.