Google and Microsoft have removed ModHeader, a widely used header-editing extension with roughly 1.6 million installs across Chrome and Edge, after researchers found a hidden browsing-history collector built into the version distributed through the official stores, as reported by The Hacker News.

Browser extensions are an uncomfortable amount of trust in a small package. To do their job they often need permission to read and change the pages you visit, which means a malicious or compromised extension has a front-row seat to your browsing, your sessions, and sometimes your credentials. ModHeader is a developer tool, so it sat in exactly the browsers where sensitive internal systems get used.

The detail that stings is that it came from the official store. Users are told that installing from the Chrome Web Store or the Edge add-ons catalog is the safe path, and mostly it is, but review is not a guarantee, and an extension can change hands or ship an update that adds behavior no one signed up for. A large install base makes that a valuable thing to slip past review.

The practical response is to remove ModHeader if you installed it, and to treat extensions as the privileged software they are. Audit what is installed, remove what you do not use, prefer extensions with a clear maintainer and a reason to be trusted, and remember that the code closest to your browser can see the most.

Sources: The Hacker News.