Is ModHeader safe?

Question

Is ModHeader safe?

Accepted Answer

ModHeader is high risk. The service worker contains a code path that, for every page you navigate to, takes the site's domain, encrypts it with a built-in key, and increments a per-domain visit counter held in a local IndexedDB store. On a roughly daily schedule the full set of counters is encrypted again and POSTed to api.stanfordstudies.com/app/log, a domain unrelated to the extension's stated header-modification purpose and not described in the Chrome Web Store listing. In the shipped build this collection path is gated behind an allow-list array that ships empty, so it stays dormant until that list is populated; the code, the built-in AES-GCM key, and the destination are all present and complete.

Is ModHeader - Modify HTTP headers safe?

Findings