!! A widely used browser extension, ModHeader,



 !! A widely used browser extension, ModHeader, has been removed from the Chrome Web Store after researchers found that its signed release contained a dormant capability to collect, encrypt, and potentially upload users' browsing-domain data.


The extension reportedly had about 1.6 million combined installations across Chrome and Microsoft Edge. ModHeader is a legitimate developer utility for modifying HTTP request and response headers.


Its broad permissions are expected for that function. However, they also give it the ability to interact with traffic and pages across all websites a user visits.


#cybersecuritynews

Comments

Post a Comment

Popular posts from this blog

Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability

Image
An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code. According to Island, the extension, named Adblock for YouTube, has more than 10 million installs and carries a Featured badge on the Chrome Web Store. The extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) description states that it allows users to prevent web page elements like ads, including preroll ads, from being displayed on the video sharing platform, as well as on external sites that load YouTube. While the add-on offers the promised functionality, it also features capabilities to run arbitrary JavaScript code. "It also contains the architectural ingredients for arbitrary JavaScript execution on any website, activated by a single server-side configuration change, without an extension update, without a store review, and without any visible sign that something has changed," researchers Oleg Zaytsev and Shachar Gritzman said in a report share...
Read more

North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

Image
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft. According to JFrog, the packages "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core" mimic the legitimate "rollup-plugin-polyfill-node" project, down to the description, repository metadata, and package shape. "The lookalike packages place themselves in the same rollup, polyfill, core, and node naming space, which can look plausible during a quick dependency review," JFrog said in a technical write-up of the campaign. The campaign also involves four other packages, all of which have since been removed from the npm registry - quirky-token react-icon-svgs rollup-plugin-polyfill-connect swift-parse-stream What's noteworthy here is that "rollup-packages-polyfill-core" installs and loads "swift-parse-stream," while "rollup-runt...
Read more

Is Your Hosting Really Protecting You?

Image
In June 2026, security researchers discovered a new malware called Gaslight. It was specifically designed to evade AI-powered malware analysis tools that researchers increasingly rely on. This malware primarily targets macOS, not WordPress directly. However, the underlying technique is a wake-up call for everyone. It proves that malware can be engineered to bypass AI-based detection, just as it can evade traditional security plugins and scanners. According to IBM's 2026 report, attacks against public-facing applications, including websites, increased by 44% over the past year. That's why I always say: running a scan alone is not security. It's only the first step of an investigation. Whether it's AI or a conventional scanner, security tools can only detect what they've been trained or programmed to recognize. A skilled security investigator, however, looks beyond automated results to uncover what's actually there. If your website shows a clean scan but something...
Read more