Executive Summary
Stripe OLT researchers identified a surveillance pipeline within version 7.0.18 of the ModHeader extension, a trusted developer tool with over 900,000 users. While the exfiltration mechanism is currently dormant due to an empty allow-list, the extension contains all necessary logic to fingerprint devices, encrypt visited domain data using a hardcoded AES-GCM key, and transmit it to attacker-controlled infrastructure. Google removed the extension from the Chrome Web Store on July 10, 2026, following disclosure.
Technical analysis confirmed that the malicious code was part of the official, signed bundle distributed through the Chrome Web Store, indicating a significant supply-chain compromise or malicious transition of a trusted tool. The infrastructure used for data collection, specifically domains like stanfordstudies[.]com and extensions-hub[.]com, appears to have been active and evolving since 2024, likely targeting high-value users such as developers and cloud administrators.
This incident highlights the volatility of browser extension trust. Organizations are urged to hunt for existing installations and block the extension ID in managed environments, as removal from the store does not automatically uninstall the extension from endpoints. The ability for a simple background update to activate this dormant surveillance makes it a critical long-term supply-chain risk.