Stylish, a browser extension with two million users, has been monitoring your browsing history for over a year.

Stylish was once a great way to remove annoying features from websites—trending topics on Facebook, say, or that annoying bar that follows you as you scroll on Medium. To do this Stylish, the browser extension, needs access to every website you visit.

RELATED: Browser Extensions Are a Privacy Nightmare: Stop Using So Many of Them

Which is why SimilarWeb, an analytics company, purchashed Stylish in 2017. SimilarWeb had no interest in customizing websites; it only wanted access to a browser extension with extensive permissions—to add a little spyware and access all of that delicious data directly.

Here’s Robert Heaton, writing on his personal blog:

Unfortunately, since January 2017, Stylish has been augmented with bonus spyware that records every single website that I and its 2 million other users visit. Stylish sends our complete browsing activity back to its servers, together with a unique identifier. This allows it’s new owner, SimilarWeb, to connect all of an individual’s actions into a single profile. And for users like me who have created a Stylish account on userstyles.org, this unique identifier can easily be linked to a login cookie. This means that not only does SimilarWeb own a copy of our complete browsing histories, they also own enough other data to theoretically tie these histories to email addresses and real-world identities.

Heaton goes on to show how this spyware works. It’s…extensive. We’ve been saying this for a long time: browser extensions are a privacy nightmare. You should check those you have installed right now and only keep the ones you absolutely depend on. Even then, maybe Google their names a little.

And seriously: uninstall Stylish. Now. We’ll do our part this week by updating our old articles and removing all links to the extension.