Home

ModHeader was removed from Chrome. Here's what happened and what to do.

In July 2026 Microsoft and then Google removed ModHeader, one of the most popular header extensions, from their stores. Researchers had found code in the official release that could collect the domains you visit. Here are the facts, what they mean for you, and how to switch without losing your profiles.

By RJ Macarthy · 3 November 2026

What happened

On 13 July 2026, the security firm Stripe OLT published an analysis of ModHeader version 7.0.18, the release that was live in the Chrome Web Store at the time. They reported that the extension's background code included a component that:

• recorded the domains of the sites you visited, encrypted them with a key built into the extension, and stored them locally;
• was written to upload that data about once a day to an outside server;
• also sent install, update and uninstall notifications to a third-party "extensions hub" server.

According to the researchers, the upload step was switched off in that build: it checks an allow-list that was empty, so the history upload didn't run. Their concern was that a later update could fill that list and turn the collection on, without Chrome asking users for any new permission.

The researchers say they verified this code against the Chrome Web Store's own signatures. In other words, it was in the genuine published extension, not a fake copy.

The removal

• 3 July 2026: Microsoft removed ModHeader from the Edge Add-ons store.
• 10 July 2026: Google removed it from the Chrome Web Store.
• 3 November 2026: when we last checked, the Chrome Web Store listing was still unavailable.

Coverage at the time put ModHeader at roughly 900,000 Chrome users, and around 1.6 million including Edge.

Was my data stolen?

There are no public reports confirming that browsing data was actually uploaded from users' browsers. The researchers describe a capability that was present but dormant in the version they analysed, plus active install/uninstall telemetry. We don't know more than the published reports, and we're not making claims beyond them. Read the sources below for the details.

What you should do

1. Export your profiles first, if you still have ModHeader installed. Open ModHeader, use the profile menu and choose Export to save a JSON file. Exporting is a local operation in your browser.
2. Uninstall ModHeader. Go to chrome://extensions and click Remove. The store removal stopped new installs, but it doesn't remove the extension from browsers that already have it.
3. Check your other computers. Chrome sync can reinstall extensions on your other signed-in browsers, so remove it everywhere.
4. Move to a replacement you can check. A header extension needs access to your traffic to do its job, so choose one whose code you can read and which doesn't send data anywhere. See choosing a ModHeader alternative.

Why this keeps happening with extensions

Popular extensions are valuable: they already have permission to see a large share of people's browsing, so they attract buyers, "monetisation partners" and data brokers. A header editor is a particularly sensitive case because it needs broad site access and runs on every request.

The lesson isn't "never use a header extension". It's to prefer ones that are easy to audit: readable code, no analytics, no remote code, and as few network connections as possible, ideally enforced by Chrome rather than promised in a privacy policy.

How ProperHeader is different

We built ProperHeader because of this kind of risk, so we'll be specific about what it does:

• No analytics, telemetry or ads. The free plan makes no network requests at all.
• One possible connection, enforced by Chrome. The extension's Content Security Policy only allows connections to extensionpay.com, for the Pro licence check. Chrome blocks anything else.
• Plain, unminified JavaScript. Every line Chrome runs is readable in the package.
• No site access until you grant it. You choose the sites, and you can revoke access at any time.
• Rules run in Chrome's own engine (declarativeNetRequest). Chrome modifies the requests itself; the extension doesn't read your page content.

Details are in the privacy policy, which lists every network request the extension can make.

Sources

• Stripe OLT: Hidden exfiltration capability discovered in a trusted, 900,000-user Chrome Web Store extension (published 13 July 2026, updated 28 October 2026). This is the original technical analysis.
• Cybernews: Google removes popular Chrome extension: hidden surveillance code found
• TechNadu: Google and Microsoft pull ModHeader extension over data collector
• PiunikaWeb: 900,000 people used this Chrome extension, and it was one update away from spying on them

Questions