"Save image as Type" was removed: six extensions now use the name

Short answer: Google blocked and removed the original in March 2026 after it was found injecting its own affiliate links. Searching the store for that name today returns six different extensions with six different publishers, from 1,000 to 100,000 users. Star ratings will not tell you which is safe: the removed one had at least a million users. What does tell you something is the permission list, the privacy practices tab, and watching what an update asks for. All three take about five minutes to check, and this guide walks them.

What happened to the original

In March 2026, 9to5Google reported that the image-saving extension was "blocked and removed from the Chrome Web Store". The article says the extension "had at least one million users" and that the problem was "First reported by users on Reddit". Citing XDA, it says the extension's code "injected its own affiliate links from 578 identifiable sites", diverting commissions from the original links, and that "The entire list may be larger."

The old listing is still reachable at its item id, and it is empty. We fetched chromewebstore.google.com/detail/gabfmnliflodkdafenbcpjdlppllnemd on November 3, 2026: it redirects to a /detail/empty-title/ address and the page title is just "Chrome Web Store". No name, no publisher, no download.

Worth being precise about what went wrong, because it decides what you should check. The extension was not broken and it did not stop saving images. It kept doing its job while quietly rewriting links on shopping pages. It also did not arrive that way: it was a long-standing, popular, well-reviewed extension, and the behaviour came in an update to it.

Six listings carry the name today

We searched the Chrome Web Store for save image as type on November 3, 2026 and read the first page of results, then opened each listing. Six of the ten cards are named some variant of the removed extension's name:

Read from each listing's own store page, November 3, 2026. None of these is the removed extension, which has a different item id and an empty listing.

We are not saying any of these six is unsafe. We have not audited their code and we are not going to guess in public about other developers. Two things in that table are worth your attention as a shopper, though, and both are facts rather than opinions:

• Ratings span 3.4 to 4.9 and tell you nothing about this risk. The extension Google removed was rated highly by a million users right up to the week it was pulled. Affiliate-link injection is invisible to the person saving an image, so it does not generate bad reviews. A rating measures whether an extension works, not what else it does.
• Two of the six point at the same website (both list a prepphint.com address), under different listing names and different contact emails. That is not wrongdoing. It is a reason to check the publisher behind a listing rather than the listing name, since one developer can hold several.

How to check an image extension yourself

Five steps, no tools, about five minutes. They work on any extension, including ours.

1. Read what it can reach, not what it promises

Go to chrome://extensions, press Details on the extension, and find Site access. An extension that converts the image you right-click does not need to read every page you visit. If the line says On all sites, it can read and change the content of every site you open, including your bank and your webmail, whether or not it ever does. That is the permission that makes affiliate injection possible.

The same page shows Permissions. For a save-an-image tool, downloads and contextMenus are expected. Host permissions for whole sites are the thing to question.

2. Read the Privacy practices tab on the store listing

Google requires this. Its developer documentation says "You must disclose how your extension collects and uses user data", including "The nature of the data that the extensions collects from users", plus "Your certification that the extension complies with the policy on limited use". Those answers are shown to you in the Privacy practices section of the listing.

Two readings matter. If the section says the publisher has not provided information about data collection, you are being told that nobody has certified anything. And if the declared collection is broader than the job, for instance web history or website content for a tool that converts a file, the gap between the two is the question to ask.

3. Treat an update as a new decision

This is the step that would have caught the original. Extensions update themselves silently, and an extension that gains new permissions in an update is disabled until you accept them. If Chrome ever tells you an extension needs new permissions, that prompt is the most important one you will see: read what is being added and why a tool you already use would now need it. The same goes for an extension that changes hands; a new publisher inherits all the access you granted the old one.

4. Check the publisher, not the name

As the table above shows, the name is worthless as an identifier. Look at who is offering it, whether a real site and support address sit behind it, and whether that site exists and says who runs it. A free webmail address is not proof of anything, and plenty of good extensions are made by one person, but it is one more thing you can see.

5. Read the code, if you want to

You already have it. An installed extension's files sit on your own disk, unencrypted, one folder per item id and version. On Windows that is under %LOCALAPPDATA%\Google\Chrome\User Data\<profile>\Extensions\<item id>\<version>. Open manifest.json to see the declared permissions, and the background or service worker file to see what it does. Affiliate injection shows up as code that rewrites links or redirects navigation, so a search through those files for http, redirect or tag= goes a long way. This is the only check on the list that does not depend on trusting a disclosure.

What we did with ours, and how to verify it

Image Type Saver is our replacement for that right-click menu. Rather than ask you to trust the claim, here is how each one is checkable by the steps above:

• No site access when you install it. Chrome shows no "read all your data on all websites" warning at install. Verify it with step 1: chrome://extensions, Details, Site access reads no additional site access.
• The conversion runs on your device, in a hidden page belonging to the extension. Nothing is uploaded. There is no account, no analytics and no ads, so there is nothing to disclose in step 2 beyond that.
• It does not touch links or navigation. There is no code to rewrite a URL in it, which step 5 will show you faster than we can argue it.
• Honest scope, version 1.0.0. Images the page is allowed to read are converted with no prompt at all. An image served from a different site than the page you are on, where that site does not permit other pages to read it, cannot be read in 1.0.0: that save fails and the toolbar icon shows a warning. A fix for those images is built and will arrive in the next update.

It is free for single images. Pro ($6 once) saves every image on a page and sets quality, a maximum width and file names. It is in the Chrome Web Store, and the same five steps apply to it.

And the honest disclosure in the other direction: we are the publisher, this page exists to be found by people searching for a replacement, and we have 6 users and no ratings. By step 1 through 5 that last fact should not move you either way, which is rather the point of the guide.

If you would rather not install anything

You do not have to. Chrome saves the file the site sent, so a WebP stays a WebP, but you can convert it afterwards on your own machine with software you already have. We wrote that up separately: Convert WebP to PNG or JPG on your own computer, with nothing uploaded.

Sources

• 9to5Google, "Image-saving Chrome extension removed as malware", March 16, 2026: 9to5google.com/2026/03/16/image-saving-chrome-extension-removed-as-malware
• Chrome Web Store developer documentation, privacy declarations in the dashboard: developer.chrome.com/docs/webstore/cws-dashboard-privacy
• The removed listing, its item id and its empty page; the store search results and the six listings' own pages: fetched by 1088 Labs on November 3, 2026.