Google and Microsoft Pull ModHeader Extension

Google and Microsoft removed ModHeader, a header-editing extension with 1.6 million installs, after Stripe OLT found a dormant browsing-history collector in its official code. The collector ships encrypted and gated by an empty allow-list, but could activate via a routine update. The extension also pinged extensions-hub[.]com on install and logged request metadata locally.