Microsoft and Chrome have recently removed the HTTP header editor extension ModHeader as researchers have found a hidden browser history collector inside the code of the extension. Packaging inconsistencies and unrelated domains have been found inside the code, alluding to a deeper issue in the extension. The dormant collector logs each domain a user has visited to be sent to a exfiltration channel that leads to a third-party domain. These functions are unactive within the extension itself, but can be activated any time the extension is updated. This threat can be avoided by uninstalling the extension and refiguring and information the extension could have logged.