The extension, which allowed users to save images in different file formats directly from the browser, appeared to be a straightforward utility tool. However, Google's security review revealed that it had been modified to include data harvesting code that collected browsing activity and sold it to third parties.

Affected users are being notified through Chrome's extension management interface, with Google recommending immediate removal. The incident highlights the ongoing challenge of maintaining security in browser extension ecosystems, where popular tools can be acquired or modified to include malicious functionality.

This is not an isolated case. Chrome extensions have repeatedly been weaponised after being sold to new owners who inject tracking or malware code. The extension marketplace model, where developers can transfer ownership of popular extensions, creates a persistent attack vector that affects millions of users.