Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found

Researchers found a dormant but fully-implemented browsing-history collector inside the official ModHeader Chrome/Edge extension (≈1.6M installs) that fingerprints devices, encrypts and stores up to 1,000 domains, and can daily POST that data to api.stanfordstudies.com; although the upload gate used an empty allow-list so no confirmed exfiltration occurred, the extension also logged request metadata in plaintext and pinged extensions-hub.com on lifecycle events, prompting Google and Microsoft to remove the listings and advising users to uninstall and block the related domains.