If you use a Chrome or Edge extension to manage your focus, your headers, your passwords, or anything else, the ModHeader takedown is worth five minutes of your time. Not because ModHeader itself was a fringe tool, it had 1.6 million installs and a decade of trust, but because of exactly how it hid what it was doing.
What actually happened On July 3, 2026, Microsoft removed ModHeader from the Edge Add-ons store. On July 10, Google followed and pulled it from the Chrome Web Store. Security firm Stripe OLT found that the official, cryptographically signed extension contained a complete browsing-history collector: it fingerprinted the device, encrypted the domain of every page visited, and was built to upload the list daily to an external server. The collector had not shipped active, an empty internal allow-list kept it switched off, but populating that list required nothing more than a routine update, no new permissions, no click from the user.
Why this matters even if you don't use ModHeader
ModHeader is a developer tool for editing HTTP headers, not a productivity extension. But the pattern it revealed applies directly to focus timers, tab managers, and any other extension that asks for broad access:
Why automated scans missed it
- Encryption hid the payload — a scanner sees ciphertext, not a domain list, so nothing readable ever left the device during testing.
- An empty allow-list gated the upload — the collection code ran, but the network call it fed into simply never fired, so sandboxes saw no outbound traffic.
- The malicious code was minified into a legitimate, working feature — the extension still did exactly what it advertised, which is what most manual reviews check for.
Automated risk checkers rated the extension as low risk, some as high as 95 out of 100. A signed listing with years of good reviews told users it was trustworthy. Neither signal caught it.
A practical checklist before you trust an extension
Open chrome://extensions, click "Details" on anything you rely on daily, and check: does it ask for "Read and change all your data on all websites" when its stated job doesn't need that? Has it changed hands or gone from free to "ad-supported" recently, a pattern security researchers have flagged repeatedly since 2021? Does the developer publish a privacy policy that actually matches what the code needs to do? Has it pushed an update in the last few weeks with no changelog? And, if you can, does the extension work with your network connection off, a genuinely local-only tool will keep functioning; one that phones home won't.
| Sign of a lower-risk extension | Sign worth investigating |
|---|---|
| Requests only the permissions its stated feature needs | Requests broad host access "just in case" |
| Same ownership and clear changelog over time | Recently changed hands or went ad-supported |
| Works fully offline if its feature doesn't need the network | Makes network calls a purely local feature shouldn't need |
| Open about not collecting browsing data | Vague or missing privacy policy |
Google's own Chrome Web Store policy already tells developers to request the narrowest permissions a feature needs and bars collecting browsing activity outside a disclosed, user-facing purpose. Starting August 1, 2026, enforcement of stricter data-collection rules takes effect store-wide, but that's a floor, not a guarantee. It only limits what a compliant extension is allowed to do, and ModHeader wasn't disclosing what it built either.
What "local-only" actually buys you
This is the specific design choice behind SlimeForge: the timer runs entirely in your browser, keeps your session data on your device, requires no account, and makes no calls to any server, ours or anyone else's. That's not a claim you have to take on faith, it's checkable the same way the checklist above works: disconnect your network and the timer keeps running, because there's nothing for it to phone home to.
If you're evaluating any focus or pomodoro extension, including an offline-first one, the permissions tab and the "does it still work with no internet" test tell you more in two minutes than a star rating ever will.
Frequently asked questions
How did ModHeader pass Chrome's security scans for years?
The collector was encrypted and gated behind an internal allow-list that shipped empty, so the upload step never ran during scanning. A scanner sees ciphertext and no outbound traffic, which is exactly what a clean extension looks like too. Researchers at Stripe OLT only found it by reading the minified code directly.
What permissions should a focus or productivity extension actually need?
A timer that runs entirely in your browser needs almost nothing beyond storage for your own settings. If a pomodoro or focus extension asks for "read and change all your data on all websites," that's broader than the feature requires, which is exactly what Chrome's own policy tells developers to avoid requesting.
Is a popular, highly-rated extension automatically safe?
No. ModHeader had 1.6 million installs, a long track record, and automated risk scores as high as 95 out of 100 rated low-risk, and still shipped a working data collector. Install count and star rating measure popularity, not what the code does after an update.
Does uninstalling a bad extension remove the data it already collected?
Uninstalling removes it from your browser and clears its local storage, but it doesn't undo anything already sent to the developer's servers. If you ever pasted API keys, tokens, or passwords into an extension's fields, rotate them regardless of whether that extension turns out to have been compromised.