Chrome, Firefox, and Opera ban data-stealing Stylish extension

A lot of users may have Stylish installed, a browser extension that enables you to modify the look & feel of websites. Available for a variety of browsers, Stylish has been downloaded over 2 million times but now the extension finds itself in the crosshairs.

Apparently, Stylish was sold to SimilarWeb in January 2017, and the new owner made significant changes to the tool's privacy policy to turn it into a data capture tool. In a nutshell, Stylish spied on its users and phoned home with data about which sites you visit, Google search results, a trimmed and hashed version of your IP, your user agent, and more.

[Software engineer Robert] Heaton said Stylish has been collecting the browser histories from Chrome users since January, 2017, and from Firefox users since March. Even though the collection was disclosed, it largely escaped the notice of Google, Mozilla, and Opera—not to mention more than two million end users—until Heaton documented it. Officials with Stylish didn’t immediately respond to a request to comment for this post.

Once the issue hit the press a couple of days ago, Mozilla, Google and Opera took swift action and banned Stylish. However, this episode is another reminder that the use of browser extensions, even popular ones, isn't without dangers. Besides opening up possible attack routes, they can also secretly be spying on you, as the case of Stylish reveals.

Via: ARS Technica