ModHeader browser extension (about 1.6 million installs) pulled from Chrome and Edge stores over hidden browsing-domain collector
ModHeader, a header-editing extension with about 1.6 million Chrome and Edge installs, held dormant code to collect visited domains. Google and Microsoft removed it; no upload was seen. If you have it, uninstall it and check browser sync.
If ModHeader is installed in Chrome or Edge, uninstall it (don't just disable it) and make sure browser sync won't reinstall it on other devices. If you passed API keys, tokens or session cookies through it, change them as a precaution.
- ModHeader (Modify HTTP headers)no fixed version yet
What’s happening
Researchers at Stripe OLT found hidden code in version 7.0.18 of ModHeader, a popular tool for editing web request headers. The code was in the genuine, store-distributed package. It fingerprints the device, encrypts each domain visited, stores up to 1,000 of them locally and is built to send them to an outside server about once a day. In the version examined it did nothing, because an allow-list that switches it on was empty. The researchers say a routine update could fill that list, and they found no evidence that any browsing data was actually uploaded. Microsoft reportedly removed the Edge listing on 3 July 2026 and Google removed the Chrome listing on 10 July. Combined installs were about 1.6 million (roughly 900,000 Chrome, 700,000 Edge). Removal from a store does not remove the extension from browsers that already have it. The developer had not responded publicly in the coverage reviewed, and no later development was found. Whether earlier or later versions contain the same code has not been stated.
- What
- Poisoned software
- Affects
- ModHeader browser extension (Chrome and Edge)
- Affected
- ModHeader (Modify HTTP headers) 7.0.18 analysed; 7.0.17 also mentioned in press; no complete version list published
- Fixed in
- No fix yet
- Since
- 13 July 2026
- Closed
- 15 July 2026
Timeline
- Update
Press coverage reported both stores had pulled ModHeader, with about 1.6 million installations combined. The developer had not publicly responded, and no evidence of actual exfiltration was reported.
- Update
Stripe OLT published its findings and the removal update. The collector was switched off by an empty allow-list, and the researchers reported no observed upload of browsing history.
- UpdateNo fix yet
Google removed ModHeader from the Chrome Web Store, where it had about 900,000 users. Removal does not uninstall it from browsers that already have it.
- Made public
Security firm Stripe OLT analysed ModHeader version 7.0.18 while it was still installable from the Chrome Web Store. It found dormant code that fingerprints the device and encrypts visited domains for a daily upload to an outside server, and found the code matched Google's store verification hash.
- Update
Microsoft removed ModHeader from the Edge Add-ons store, according to a secondary report. The extension had roughly 700,000 Edge installations.
Sources
- Chrome extension hidden data exfiltration (ModHeader)Stripe OLT · 13 July 2026
- Google and Microsoft pull ModHeaderThe Hacker News · 13 July 2026
- ModHeader Pulled From Chrome: the Dormant Spyware in 1.6M BrowsersPasquale Pillitteri · 15 July 2026
- Google and Microsoft Remove ModHeader Extension After Hidden Code Found Collecting Browsing History DataThaiCERT · 15 July 2026