Stylish extension exfiltrated browsing history

Stylish was a popular browser extension for applying custom CSS to websites. After SimilarWeb acquired it, official extension updates added analytics code that collected browsing history at a level users would not expect from a style manager.

Robert Heaton's analysis showed that the extension sent full URLs to api.userstyles.org, along with tracking identifiers that could link activity to a user. That meant search queries, private pages with tokenized URLs, and account-specific browsing behavior could leave the browser.

The code was distributed through normal extension stores. Users who installed or auto-updated Stylish received the behavior as part of the trusted package, not through a separate exploit.

Mozilla and Google removed Stylish from their extension stores after the reporting. The record is included because the official distribution channel shipped privacy-invasive code after an ownership change, converting a trusted extension into a surveillance endpoint.