Google and Microsoft Pull the ModHeader Extension over a Hidden Data Collector

Google and Microsoft have removed ModHeader, an extension for editing HTTP headers, from the Chrome Web Store and Microsoft Edge Add-ons. According to The Hacker News, the official version of the extension had around 1.6 million installs across both browsers.

The removal was prompted by researchers' discovery of a hidden mechanism built into the official store version of the extension. This mechanism was capable of collecting the history of sites a user had visited.

The mechanism stayed dormant

According to the available information, the data collector that was found sat in a dormant state. Its activation was blocked by an empty permissions list (allow-list) — without domains explicitly specified in it, the information-gathering function would not run.

Researchers found no evidence that the extension had ever actually collected or transmitted data about the domains users visited. In other words, the potentially dangerous functionality was present in the code but, by all appearances, was never once put to use in practice.

The platforms' response

After receiving information about the hidden code, both Google and Microsoft promptly decided to block the distribution of ModHeader through their official extension stores. This deprived users of both browsers of the ability to install the extension through standard channels.

The ModHeader case once again shows that even widely used and seemingly vetted extensions from official stores can contain potentially dangerous code that goes unnoticed for a long time, right up until a dedicated security investigation. Users who previously installed ModHeader are advised to keep an eye on the official statements from the developers and the platforms regarding the extension's future.

Source: The Hacker News