Particle.news
Download on the App Store

Google Pulls Popular Chrome Extension Over Stealth Affiliate-Fraud Scheme

A quiet ownership change led to code that injected invisible iframes to hijack shopping commissions.

Overview

  • Google confirmed the “Save Image as Type” add-on was globally disabled and removed from Chrome in March 2026.
  • The extension surpassed one million installs and carried a Chrome Web Store recommendation that amplified user trust.
  • Technical reviews found clean early versions turned malicious in late 2024, with version 1.7.2 loading remote URLs and injecting iframes across more than 570 sites.
  • Researchers observed evasion tactics that delayed activation until roughly ten image saves and avoided developer-focused pages detected via fonts.
  • Microsoft removed the Edge build as malware in February 2025, and experts advise uninstalling the extension and clearing site data to remove remnants such as the 'ldcsv' localStorage marker.