Google and Microsoft Remove ModHeader After Dormant Browsing-History Collector Found
Summary
Researchers found a dormant browsing-history collector and active metadata tracking in the genuine ModHeader extension. Its empty allow-list prevented the collector from running, and there is no evidence it uploaded browsing domains. Google and Microsoft removed it.
Key points
- Researchers confirmed the collector was present in the genuine, store-signed ModHeader extension; the Chrome and Edge versions had about 1.6 million installs combined.
- An empty internal allow-list stopped the collector from gathering or uploading browsing domains; researchers found no evidence that it ever sent them.
- The code could encrypt page domains, store up to 1,000 locally, and periodically send them to api[.]stanfordstudies[.]com if the allow-list were populated.
- Separate behavior sent product, version, and browser details to extensions-hub[.]com; a page script also stored HTTP request metadata locally in plain text.
- Google removed the Chrome listing on July 10 and Microsoft removed the Edge listing on July 3. The article says users should remove the extension and rotate secrets entered into it.
- Defenders were advised to block and monitor the related domains and search logs for the extension ID and POST requests to the collector endpoint.
Article Details
- Attack Vectors
- A dormant browsing-history collector was embedded in the genuine, store-signed ModHeader extension for Chrome and Edge; its empty internal allow-list prevented it from collecting page domains.
- If enabled, the collector would encrypt page domains, store up to 1,000 distinct domains locally, and post the collected data and a device fingerprint to a remote endpoint daily.
- The extension also pinged an external domain on install, update, and uninstall, and stored request metadata, including full HTTP headers, locally in plain text.
- Defensive Notes
- Remove ModHeader from Chrome and Edge, and check that profile sync or managed extension policies will not reinstall it.
- Rotate API keys, bearer tokens, session cookies, and other secrets entered into the extension because its header-history feature stored full HTTP headers locally.
- Block and log stanfordstudies[.]com and extensions-hub[.]com at DNS and proxy; search logs for the extension ID and POST requests to api.stanfordstudies[.]com/app/log.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | extensions-hub[.]com | External domain pinged by the extension on install, update, and uninstall with product, version, and browser information; defenders were advised to block and monitor it. |
| DOMAIN | stanfordstudies[.]com | Domain associated with the extension’s remote collector; defenders were advised to block and monitor it. |
MITRE ATT&CK
T1005 · Data from Local SystemThe extension stored collected page domains and request metadata, including full HTTP headers, in local storage.T1041 · Exfiltration Over C2 ChannelWhen enabled, the collector was designed to send its encrypted domain list and device fingerprint to a remote endpoint in a daily POST.T1071.001 · Web ProtocolsThe extension used a POST request to its remote API endpoint to upload collected data.T1119 · Automated CollectionThe extension’s background code automatically collected the domain of each page opened by the browser when its allow-list condition was met.T1176 · Software ExtensionsThe collector and tracking behavior were embedded in the ModHeader browser extension distributed through the official Chrome and Edge stores.
People
Vendors
GoogleGoogle and Microsoft removed ModHeader, a widely used header-editing extension, after researchers found a dormant browsing-history collector hidden inside its official store version.MicrosoftGoogle and Microsoft removed ModHeader, a widely used header-editing extension, after researchers found a dormant browsing-history collector hidden inside its official store version.