Chrome Extension Used by 1.6 Million Users Silently Included Data Exfiltration Capabilities
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A widely used browser extension, ModHeader, has been removed from the Chrome Web Store<\/a> after researchers found that its signed release contained a dormant capability to collect, encrypt, and potentially upload users\u2019 browsing-domain data.<\/p>\n The extension reportedly had about 1.6 million combined installations across Chrome and Microsoft Edge. ModHeader is a legitimate developer utility for modifying HTTP request and response headers.<\/p>\n Its broad permissions are expected for that function. However, they also give it the ability to interact with traffic and pages across all websites a user visits.<\/p>\n Researchers examining ModHeader version 7.0.18 identified code for a browsing-history collection pipeline inside the extension\u2019s background service worker.<\/p>\n The logic was designed to extract domains from visited URLs, encrypt them with a hardcoded AES-GCM key, and store the encrypted records in IndexedDB.<\/p>\n The pipeline used two local data stores: a settings store for a persistent installation fingerprint, encryption initialization vector, and upload timing data and a temp store for encrypted domain records<\/a> and visit counters.<\/p>\n The implementation was reportedly configured to retain up to 1,000 distinct domains before forcing an upload. The code also included an outbound POST routine pointing to https:\/\/api.stanfordstudies.com\/app\/log.<\/p>\n According to StripeOlt\u2019s analysis<\/a>, the payload contained encrypted browsing data, device fingerprint information, and browser details.<\/p>\n The uploader was built to retry failed requests and erase locally staged domain data after a successful transmission, reducing available forensic evidence.<\/p>\n However, researchers stressed an important distinction: the history-collection function in the analyzed build was gated by an empty allow-list.<\/p>\n Because no browser identifier was included in that list, the collection and upload path did not execute in that version.<\/p>\n The concern is that the complete collection, encryption, storage, scheduling, and transmission framework was already in place and could be enabled via a routine extension update without requesting new permissions.<\/p>\n The extension also contained active telemetry functionality tied to extensions-hub.com, reporting install, update, and uninstall events.<\/p>\n This tracking is separate from the dormant browsing-history upload capability. However, it demonstrates that the extension was already communicating with third-party infrastructure.<\/p>\n Google and Microsoft have reportedly pulled ModHeader from their respective extension stores, with Microsoft\u2019s removal occurring on July 3 and Google subsequently flagging the extension as malware<\/a>.<\/p>\n Organizations should hunt for extension ID idgpnmonknjnojddfkpgkljpfnnfcklj, block or monitor stanfordstudies.com and extensions-hub.com, and remove the extension from managed browser environments.<\/p>\n Users who relied on ModHeader for API testing should also review and rotate sensitive values previously placed in custom headers, including API keys, authorization tokens, and session cookies.<\/p>\n Researchers from aydinnyunus.github noted <\/a>that the incident exposes a long-standing browser supply chain issue: while Chrome Web Store signatures confirm an extension\u2019s origin, they do not ensure that every capability introduced in later updates is safe.<\/p>\n High-permission extensions should be governed as third-party software, with allowlists, inventory monitoring, and periodic behavioral review.<\/p>\n Indicator of Compromise<\/strong><\/p>\n Note:<\/strong>\u00a0<\/strong>IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.<\/em><\/p>\n \u00a0Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0-> Integrate ANY.RUN With Your SOC <\/a>Now<\/a><\/strong>.<\/strong><\/p>\n The post Chrome Extension Used by 1.6 Million Users Silently Included Data Exfiltration Capabilities<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nChrome Extension for Users Data Exfiltration<\/strong><\/h2>\n
\n\n
\n Type<\/strong><\/th>\n Indicator<\/strong><\/th>\n Context<\/strong><\/th>\n<\/tr>\n<\/thead>\n\n \n Extension ID<\/td>\n idgpnmonknjnojddfkpgkljpfnnfcklj<\/code><\/td>\nModHeader<\/td>\n<\/tr>\n \n Version<\/td>\n 7.0.18<\/code><\/td>\nAffected release<\/td>\n<\/tr>\n \n Exfiltration URL<\/td>\n https:\/\/api.stanfordstudies.com\/app\/log<\/code><\/td>\nSuspected data upload<\/td>\n<\/tr>\n \n Telemetry Domain<\/td>\n extensions-hub.com<\/code><\/td>\nInstall\/update tracking<\/td>\n<\/tr>\n \n Data Collection Domain<\/td>\n stanfordstudies.com<\/code><\/td>\nSuspected infrastructure<\/td>\n<\/tr>\n \n Shared IP<\/td>\n 3.147.61.167<\/code><\/td>\nAssociated AWS IP<\/td>\n<\/tr>\n \n IndexedDB Stores<\/td>\n \n settings<\/code>, temp<\/code>\n<\/td>\nLocal data storage<\/td>\n<\/tr>\n \n Service Worker<\/td>\n assets\/src\/background-94ad634d.js<\/code><\/td>\nCollection logic<\/td>\n<\/tr>\n \n Static Marker<\/td>\n mod\u76d0header<\/code><\/td>\nHardcoded string<\/td>\n<\/tr>\n \n Author String<\/td>\n modhader@<\/code><\/td>\nManifest artifact<\/td>\n<\/tr>\n \n AES-GCM Key<\/td>\n aWfU3yG_wksZaQdSnxPJBOId0cAN8KK\/UIlZbli7-bE<\/code><\/td>\nEmbedded encryption key<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n