uBlock Origin author Raymond Hill and German security privacy blogger Mike Kuketz report that a popular Firefox extension will quietly collect user browsing history. The add-on is called Web Security, with more than 220,000 installations and even recommendations from the official Firefox blog.
But Hill quickly noticed that the extension showed a strange behaviour: after installation, whenever a user’s browser loads a web page, it sends a POST to http://184.108.40.206/. The POST data was confusing, and the user deciphered the data and found that it was the URL that the user visited.
Hill said, “With this extension, I see that for every page you load in your browser, there is a POST to http://220.127.116.11/. The posted data is garbled; maybe someone will have the time to investigate further.”
The data shows that the extension tracks the user’s browsing mode by monitoring the user with an ID. This extension has now been removed from addons.mozilla.org.