Your favorite image-saving Chrome extension was scraping your data for cash

Seemingly out of nowhere, the “Save image as Type” Chrome extension was marked for removal, with Google warning users that the extension contains malware. The extension had at least one million users.

First reported by users on Reddit, the “Save image as Type” extension no longer works on devices running Google Chrome. It was blocked and removed from the Chrome Web Store, with the extension page no longer live.

The extension allowed users to download images from the web in several formats normally restricted by the site administrator. That included saving images in JPG or PNG format, otherwise impossible through the right-click menu.

According to a report from XDA, the extension contained malicious code inside the inject.js file. That code would trigger communication with a server and compile a list of URLs. The extension would then use that information to load in corresponding affiliate codes, essentially stealing commissions from the original clicked link.

The save image extension reportedly injected its own affiliate links from 578 sites, scraping money from customer purchases after the extension was used to download an image. While it doesn’t appear that the extension was placing malware on devices explicitly, it was utilizing sketchy data practices to scrape data from users without explicitly saying so, similar to Honey.

It appears that the Chrome extension changed ownership in August, 2024. At that time, the developer’s email changed from one “Lauren Bridge” to Image4Tools. That would suggest the extension was sold and, after amassing at least 1,000,000 users, began scraping affiliate data and injecting its own.

Microsoft reportedly removed this extension from Edge several months after the malicious network was documented in late 2024, though it had been operating on Chrome until March 2026.

For users looking for an alternative, “Save Image As PNG” seems to be a viable option. It has half as many downloads, but looks to actually operate under Chrome’s acceptable user practices.