ModHeader Chrome Extension Exposes 900,000 Users to Hidden Data Exfiltration Risk

Google removed the ModHeader extension from the Chrome Web Store on Friday, 10 July. Organizations should still hunt for existing installations and remove them from managed and unmanaged browsers where present.

The Stripe OLT SOC has uncovered dormant surveillance functionality inside ModHeader, a Chrome Web Store extension with roughly 900,000 users.

Version 7.0.18, live and installable at the time of analysis on 6 July 2026, contained a fully built browsing-history collection and exfiltration pipeline that was disabled in this build but entirely functional.

Beneath ModHeader’s legitimate header-editing functionality, Stripe OLT found a device-fingerprinting routine that generates a stable identifier and an AES-GCM initialization vector on the extension’s first run.

ModHeader Chrome Extension Exposes 900,000 Users

A hardcoded AES-GCM encryption key then ciphers every visited domain before it is staged locally in an IndexedDB store, and a scheduler prepares daily, jittered uploads of that encrypted data to an endpoint at api[.]stanfordstudies[.]com.

Separately, install, update, and uninstall events are beaconed to a second domain, extensions-hub.com, and a content script injected into every page visited logs request metadata into local storage.

Crucially, the exfiltration trigger is gated by an empty allow-list, meaning uploads never actually fire in this build.

Every other component, including the encryption key, the endpoint, the scheduler, and the storage, is present and could be activated via a routine, silent update that requires no new permissions and no user interaction.

Stripe OLT verified the malicious service worker against Google’s own Chrome Web Store content-verification signatures, recomputed SHA-256 tree hashes for the executable files, and compared them against the signed root hash in the extension’s verified_contents.json manifest.

The hashes matched exactly, confirming the code was distributed through the official Chrome Web Store listing rather than a sideloaded impersonator using ModHeader’s identity.

Open-source intelligence tracing revealed that stanfordstudies.com, despite its academic-sounding name, is an aged, repurposed domain with no connection to Stanford University.

It hosts an exposed OpenSearch cluster on AWS us-east-2, built in September 2024, that appears sized for large-scale telemetry ingestion.

Notably, the exfiltration endpoint and the extensions-hub.com advertising API currently resolve to the same AWS-hosted IP address, consistent with the possibility that both services share an operator or underlying infrastructure.

This pattern echoes a documented history: a 2023 thread flagged ModHeader for injecting ads into search results, alongside older user complaints about being converted into an ad-fraud proxy, suggesting a monetization pivot that later escalated into a fully built surveillance capability.

Stripe OLT confirmed that third-party reputation services rated the extension as low risk, with scores as high as 95 out of 100 and no malware flagged.

This happened because the collected data is encrypted, so scanners see only ciphertext rather than URLs; the exfiltration gate means sandboxed dynamic analysis observes no outbound history traffic; and the malicious logic is minified and blended into a large legitimate codebase alongside a well-known database library.

With approximately 900,000 installations likely spanning corporate and personal devices, and given that ModHeader’s user base skews toward developers, QA engineers, and cloud administrators, any future activation of this dormant capability could expose internal applications, VPN portals, identity providers, and sensitive URLs containing tokens or credentials.

Security teams should block the extension ID idgpnmonknjnojddfkpgkljpfnnfcklj across managed Chrome environments, hunt for outbound network traffic to stanfordstudies.com and extensions-hub.com, and check endpoints for IndexedDB artifacts under the extension’s leveldb path.

Google’s removal of the listing reduces the risk of new installations, but it does not remediate machines where the extension is already installed, so continued detection and removal remain necessary.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.