Proprietary · · 549 days

Stylish extension exfiltrated browsing history

After SimilarWeb acquired Stylish, official browser-extension updates began silently exfiltrating complete browsing histories. The data included full URLs, search results, and account-linked tracking identifiers.

Stylish was a popular browser extension for applying custom CSS to websites. After SimilarWeb acquired it, official extension updates added analytics code that collected browsing history at a level users would not expect from a style manager.

Robert Heaton's analysis showed that the extension sent full URLs to api.userstyles.org, along with tracking identifiers that could link activity to a user. That meant search queries, private pages with tokenized URLs, and account-specific browsing behavior could leave the browser.

The code was distributed through normal extension stores. Users who installed or auto-updated Stylish received the behavior as part of the trusted package, not through a separate exploit.

Mozilla and Google removed Stylish from their extension stores after the reporting. The record is included because the official distribution channel shipped privacy-invasive code after an ownership change, converting a trusted extension into a surveillance endpoint.

Appendix · Affected releases

Stylish browser extension store
  • The Chrome extension id fjnbnpbmkenffdnngjfgmeleoegfcffe was established on 2026-09-02 and added because the record carried no identifier, so nothing could be queried for it.
  • It was confirmed against the live Chrome Web Store listing, "Stylish - Custom themes for any website" published by Similarweb LTD, the acquirer whose tracking is the subject of this record, which is what makes it the right id.
  • Stylish was pulled from both stores in July 2018 and the listing resolving today is the later one, so the id addresses the listing and its publisher, not specifically the 2018 build. The Firefox add-on page is recorded alongside it.
  • The malicious CRX is not retrievable, checked 2026-09-03. crx4chrome supplied this record's digests but its download pages now 404, the Internet Archive holds no capture, and Chrome serves only the current version.

References

  1. Stylish browser extension steals all your internet historyrobertheaton.com
  2. Stylish browser extension dropped by Chrome and Firefox after data slurp reporttheregister.com
  3. Stylish Firefox and Chrome extension banned for tracking browsing historybleepingcomputer.com

Source record: proprietary/stylish/meta.yaml