Interpose
Interpose
Set an Authorization token. Spoof a User-Agent. Strip a Referer. Force a CORS header onto a response. One switch turns all of it off — and nothing you configure ever leaves your machine.
{{uuid}}, {{timestamp}}, {{isotime}}, {{random}}, {{randint}}.Interpose registers no content scripts. It never runs code inside a site, so it cannot see what you type or where you browse — not by policy, but because the permission that would allow it isn't in the manifest. That is a structural guarantee, and you can check it yourself in about ten seconds.
Header changes happen through Chrome's declarativeNetRequest API,
at the network layer, without the extension ever seeing your page.
ModHeader was the default header editor for years. In July 2026, UK security firm Stripe OLT reported a hidden browsing-history collector in version 7.0.18: it fingerprinted the device, encrypted the domain of every page opened, held up to a thousand of them, and posted the bundle to an external server on a daily schedule.
It was dormant. An empty allow-list kept it switched off, and no evidence has emerged that it ever transmitted a single domain. Both stores removed it anyway.
Per Stripe OLT's analysis as reported by The Hacker News, 2026. Figures are the installs published on the extension's store listings before removal.
The problem was never that it was running. The problem was that it could — a header editor had the reach to watch where you browsed, and nobody noticed for as long as it stayed quiet.
Interpose cannot do this, and not because it promises not to. Modifying headers happens at the network layer; seeing pages requires a permission that simply isn't in its manifest. The whole permission list is three entries long, and it's the first thing in the repository. It also imports ModHeader's own exports, so switching costs you nothing.
The whole extension is under 1,000 lines with no dependencies and no build step, so what's published is exactly what runs. The file that decides what happens to your traffic is about 200 lines. You don't have to trust any of this — you can read it.
Interpose carries no ads, no telemetry and no analytics — which also means it earns nothing. It's built and maintained by one person, and it stays honest because it isn't funded by anything that would make it dishonest.
If it saves you time, you can sponsor it. Entirely optional: sponsoring unlocks nothing, no feature is held back from anyone, and the extension behaves identically either way. There's no nag screen — this paragraph is the whole ask.
Stated here rather than discovered after you install.
accept-encoding cannot be changed.
Chrome rewrites it after extensions run, because it has to control which
compression formats it can decode. No extension can change this one.
append works on a fixed list of headers.
Chrome permits it for accept, accept-language,
cache-control, cookie, user-agent and a
handful of others. Use set for anything else.
Dynamic values resolve when rules compile, not per request.
Chrome's rules hold fixed values once registered, so a {{uuid}}
stays the same until you roll it. There's a button for that.