ModHeader Removed From Chrome & Edge — What Happened and What to Do — HeaderSnap ModHeader was removed from Chrome & Edge over a hidden data collector — what happened and what to do
HeaderSnap
← All posts
July 13, 2026

ModHeader Removed From Chrome and Edge: What Happened and What to Do

If you edit HTTP headers as part of your job, there’s a good chance the tool you reach for just disappeared from two browser stores.

In July 2026, both Google and Microsoft pulled ModHeader — for years the default extension for editing HTTP request and response headers — after security researchers found a hidden browsing-history collector buried inside the official, signed version of the extension. With roughly 1.6 million combined installs across Chrome and Edge, this is one of the larger developer-tool removals in recent memory.

Here’s what actually happened, whether your data is at risk, and what to do next — in plain language, without the scare-headline spin.

What happened

The timeline is short and unusually clear:

  • July 3, 2026 — Microsoft removed the ModHeader listing from the Edge Add-ons store.
  • July 10, 2026 — Google removed it from the Chrome Web Store, a week later.

The trigger was an analysis from Stripe OLT, a UK-based security firm. Crucially, they checked the suspicious code against Google’s own Web Store signature and confirmed it shipped inside the genuine extension — this wasn’t a counterfeit clone or a hijacked account pushing a one-off bad build. The collector was in the real thing that ~900,000 Chrome users and ~700,000 Edge users had installed.

As of the initial reporting, ModHeader’s developer had not responded publicly to the findings.

What the researchers found

The extension still did its advertised job — editing HTTP headers — but version 7.0.18 (extension ID idgpnmonknjnojddfkpgkljpfnnfcklj) carried a second system alongside the legitimate code. That system was a browsing-history collector, wired up and ready to run.

Here’s what researchers described inside it:

- A unique device fingerprint, generated on first run
- A hardcoded encryption key, loaded at startup
- Local storage for up to 1,000 visited domains, encrypted
- A daily upload routine targeting an external server
  (api.stanfordstudies[.]com)
- Randomized per-install upload timing, to avoid
  synchronized "beacon" traffic that's easy to spot

In other words: everything you’d need to quietly record which sites a person visits, package it up, and ship it off — including the small operational details (randomized timing) that a collector uses to stay under the radar.

Was your data actually stolen?

This is the part that deserves an honest answer rather than a headline.

Probably not — but only because a switch happened to be off.

The collector was dormant. It was gated behind an allow-list that shipped empty, which means the pipeline stopped before it ever recorded a single domain. Researchers found no evidence that ModHeader gathered or transmitted anyone’s browsing history.

The problem is what that arrangement represents. Every other component was fully built and in place. Turning the collector on didn’t require a rewrite or a clever exploit — it required a future update to drop a value into that allow-list. For an extension that auto-updates silently in the background, “one config change away from active” is not a comfortable place to sit.

So: no confirmed harm, but a loaded mechanism pointed at 1.6 million browsers. That’s why both stores pulled it rather than waiting to see what happened next.

What you should do right now

If you or your team have ModHeader installed:

  • Remove it from Chrome and Edge. Your browser may have already disabled it automatically, but confirm it’s gone rather than assuming.
  • Rotate any secrets you pasted into it. This is the step people skip. ModHeader’s header-history feature stored full HTTP headers on disk — which means any API keys, bearer tokens, or session cookies you added as header values were sitting in local storage. Rotate them to be safe.
  • Check that it won’t quietly come back. If you use browser sync across machines, or your organization pushes extensions via managed policy, make sure ModHeader isn’t set to reinstall itself somewhere you’re not looking.

None of these steps depend on whether the collector ever ran. They’re the right hygiene regardless.

The bigger lesson

It’s worth sitting with why this one stings.

A header editor is not a casual utility. It sits inside your browser and touches every HTTP request you make — it can read and modify the traffic between you and the sites you use, including the ones you’re authenticated to. That is an enormous amount of trust to hand to a browser extension, and it’s exactly the kind of access that makes a hidden collector so dangerous when it’s abused.

The practical takeaway isn’t “never install extensions.” It’s to vet the ones that live in a privileged spot like this:

  • Permissions — does it ask for more than its job needs?
  • Data collection — does the developer make a clear, verifiable claim about what it does and doesn’t collect?
  • Update behavior — who’s behind it, and do they have a track record worth trusting when the next silent update ships?

We’ve written more about why this matters specifically for header editors in why HeaderSnap is the only header editor you should trust and our zero-data-collection stance.

Migrating to HeaderSnap

If you’re now looking for a replacement, that’s exactly why we built HeaderSnap.

HeaderSnap is a clean, free HTTP header editor for Chrome with one non-negotiable principle: it collects no personal data. No browsing-history collector, no device fingerprinting, no external upload routine — dormant or otherwise. There’s nothing to switch on later, because the machinery was never built in the first place.

It also does the everyday jobs you actually used ModHeader for:

  • Add and override request headers — auth tokens, custom headers, and more.
  • Set Authorization headers for API keys and bearer tokens without touching your code.
  • Spoof the user-agent and other headers to test how a site responds.
  • Scope rules by URL pattern so your changes only apply where you want them.

If you’re weighing the full field rather than taking our word for it, we’ve compared the options honestly in the best ModHeader alternatives in 2026.

Switching takes a couple of minutes, and you get back to editing headers — this time with a tool that isn’t one update away from watching where you go.

Install HeaderSnap free →

HeaderSnap is a free Chrome extension for HTTP header editing. Built by Amalgamated Hams.