{"id":240769,"date":"2026-07-14T00:38:46","date_gmt":"2026-07-14T05:38:46","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/07\/google-and-microsoft-pull-modheader-with-1-6-million-installs-after-dormant-collector-found"},"modified":"2026-07-14T00:38:46","modified_gmt":"2026-07-14T05:38:46","slug":"google-and-microsoft-pull-modheader-with-1-6-million-installs-after-dormant-collector-found","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/07\/google-and-microsoft-pull-modheader-with-1-6-million-installs-after-dormant-collector-found","title":{"rendered":"Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/google-and-microsoft-pull-modheader-with-1-6-million-installs-after-dormant-collector-found2.jpg\"><\/a><\/p>\n<p>Google and Microsoft have pulled <strong>ModHeader<\/strong>, a popular header-editing extension with roughly 1.6 million installs across Chrome and Edge, after researchers found a hidden browsing-history collector built into its official store version.<\/p>\n<p>The collector was dormant. An empty allow-list kept it switched off, and no proof has emerged that it ever gathered or sent a single browsing domain.<\/p>\n<p>The analysis came from <a href=\"https:\/\/stripeolt.com\/knowledge-hub\/threat-research\/chrome-extension-hidden-data-exfiltration-900k-users\/\" target=\"_blank\">Stripe OLT<\/a>, a UK security firm, which checked the code against Google\u2019s own Web Store signature and confirmed the collector shipped inside the genuine extension, not a counterfeit.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Google and Microsoft have pulled ModHeader, a popular header-editing extension with roughly 1.6 million installs across Chrome and Edge, after researchers found a hidden browsing-history collector built into its official store version. The collector was dormant. An empty allow-list kept it switched off, and no proof has emerged that it ever gathered or sent a [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-240769","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/240769","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=240769"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/240769\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=240769"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=240769"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=240769"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}