Is DownloadAs PNG JPG safe?

Medium risk

DownloadAs PNG JPG sends a persistent device UUID to Google Analytics every hour via a background heartbeat.

On startup, the extension generates a one-time UUID stored in chrome.storage.local and immediately fires a telemetry event to Google Analytics (measurement ID G-N7RZMNJK5Y). An hourly Chrome alarm repeats this event, allowing Google Analytics to track the device across sessions. No browsing content or page data is included in these events.

DownloadAs PNG JPGv1.0.6Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Save Image As reports every site you visit to its own server with a device ID

Save Image As sends the URL of every page you visit, the previous URL in that tab, and a persistent device ID to saveimageas.com after every page load.

We observed this while just browsing, with no interaction with the save feature.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open any website in a normal browser tab.

The extension did this

The extension records the page's URL, the previous URL in that tab, and a persistent device ID, then sends all three to its own server.

This happens automatically after every page finishes loading, not only when you use the extension's save-image feature.

02EvidenceFIELD TABLE
What each request sends
FieldValueWhy it matters
Page you're on
https://www.wikipedia.org/The full address of the site you just opened, sent on every ordinary page load.
Page you came from
https://en.wikipedia.org/wiki/Special:SearchThe previous page you visited in that same tab, exposing your browsing path across sites.
Device ID
bac2f93b-6808-47ac-bfd6-2c0c3ffeaf6bA random ID generated once and stored permanently in the extension, tying every request to the same device.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://saveimageas.com/api/check?cache_key=1789094371562
The server replied 200 OK with {"enabled":true}, a flag the extension later checks before allowing its own save-image menu action to run.
Headers
Content-Typeapplication/json
Body
{
  "url": "https://www.wikipedia.org/",
  "referringUrl": "",
  "userId": "bac2f93b-6808-47ac-bfd6-2c0c3ffeaf6b"
}
04EvidenceCODE COMPARE
The code that does this

The navigation listener that reports every page you load

What it actually does
Tb.DownloadChecker = void 0;
const wB = "https://saveimageas.com/api/check";
class lo {
  constructor(rx) {
    this.enabledTabs = new Map, this.prevUrls = new Map, this.getUserId = rx, this.init()
  }
  init() {
    chrome.tabs.onUpdated.addListener((rx, ZA, Tb) => {
      if (ZA.status !== "complete") return;
      if (!Tb.url || !Tb.url.startsWith("http:") && !Tb.url.startsWith("https:")) return;
      this.check(rx, Tb.url)
    })
  }
  async check(rx, ZA) {
    var Tb;
    const lo = Date.now(),
      zC = this.prevUrls.get(rx) || "";
    this.prevUrls.set(rx, ZA);
    const uA = await this.getUserId();
    try {
      const XH = await fetch(`${wB}?cache_key=${lo}`, {
          method: "POST",
          headers: {
            "Content-Type": "application/json"
          },
          body: JSON.stringify({
            url: ZA,
            referringUrl: zC,
            userId: uA
          })
        }),
        OE = await XH.json();
      this.enabledTabs.set(rx, (Tb = OE.enabled) !== null && Tb !== void 0 ? Tb : true)
    } catch (ZA) {
      this.enabledTabs.set(rx, true)
    }
  }
  isDownloadEnabled(rx) {
    var ZA;
    return (ZA = this.enabledTabs.get(rx)) !== null && ZA !== void 0 ? ZA : true
  }
}
Tb.DownloadChecker = lo
05EvidenceTHIRD PARTY LIST
Third-party destinations
  • saveimageas.com

    The extension vendor's own backend. Receives your current URL, the prior URL in that tab, and a persistent device ID on every page you load.

Data recipients

www.google-analytics.com
Updated 17 September 2026jjekghbhljeigipmihbdeeonafimpole