Hidden Exfiltration Capability Discovered in a Trusted, 900,000-User Chrome Web store Extension 

A signed Chrome Web Store release of the popular ModHeader extension (v7.0.18) was found to include a dormant but complete browsing-history collection and exfiltration pipeline that fingerprints devices, encrypts visited domains with a hardcoded AES-GCM key, stages data in IndexedDB, and is designed to POST encrypted telemetry to api.stanfordstudies.com while beaconing install/update/uninstall events to extensions-hub.com; Google removed the extension from the store after responsible disclosure, but installed copies remain a significant enterprise supply-chain risk.