ModHeader, a popular header-editing browser extension with 1.6 million installs, was removed from Chrome and Edge web stores after researchers found a dormant browsing-history collector. The collector was designed to encrypt and upload browsing data but remained inactive due to an empty allow-list.