Enlarge / Google results sent to remote servers. (credit: Robert Heaton)

Google, Mozilla, and Opera have pulled a browser extension with more than two million downloads after it was caught tracking every website its users visited—and sending the data to a remote server.

The Stylish extension allowed users to customize the look and feel of websites in a variety of ways. Among other things, it could remove clutter such as Facebook or Twitter news feeds, change normal pictures to black-and-white manga images, and change black-on-white site themes to white-on-black themes. Starting this year, Stylish started performing these useful functions at a high price: according to software engineer Robert Heaton, the extension started sending users’ complete browsing activity back to its servers by default, along with a unique identifier that in many cases could be used to correlate email addresses or other Internet attributes belonging to those users.

An updated Stylish privacy policy disclosed that the extension collected browsing histories. The version published in May, for instance, said that the information included “standard web server log information (i.e., web request) as well as data sent in response to that request, such as URL used, Internet Protocol address (trimmed and hashed for anonymization), HTTP referrer, and user agent.” Various articles from January, 2017, also noted the tracking but, citing a new owner of the extension, these articles said it would be anonymous. (This despite the fact that many URLs, particularly when stored in large quantities over a long period of time, can make it painfully obvious which individual is viewing them.)