Is Clear Cache – One-Click Cache Cleaner safe?
We analyzed Clear Cache – One-Click Cache Cleaner version 1.0.3's actual code and gave it a 76/100 trust score. This is a purpose-aligned cleaner with…
Bottom line
This is a purpose-aligned cleaner with unnecessarily broad website access and a powerful, irreversible cleanup action.
What it can access
It can erase cookies, cached data, and download records across the browser, and requests every website even though page access is unused. [Q1][Q2][Q4]
Security weaknesses
One click triggers deletion from the earliest available time without confirmation or site limits, which could sign users out and erase download records. [Q1][Q4]
Signs of misuse
The reviewed package shows no tracking, outside data sharing, downloaded code, or actions triggered by websites or remote servers. [Q6][Q7][Q8][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests browsingData and can delete all cache, cookies, and download-history records, which broadly matches a cache-cleaner tool but has significant browser-wide impact. It also requests access to every website even though the implementation does not use that access.
Declares browsingData, notifications, and <all_urls> host access. — manifest.json:22-31
Removes cache, cookies, and downloads since time zero. — js/background.js:29-43
Runs the cleanup from a toolbar-click listener. — js/background.js:71-74
Which websites can it run on, and can it read or change what appears on those pages?
The manifest grants host access to every URL, which could support cross-origin requests, but the reviewed version contains no page access, scripting permission, page page access, or network request. The permission is unnecessary and should be removed.
Requests <all_urls> as a host permission. — manifest.json:27-31
Declares no content_scripts or scripting permission. — manifest.json:1-38
The complete runtime contains no fetch, XHR, page injection, or DOM operation. — js/background.js:1-74
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
clearCache calls chrome.browsingData.remove with deletion options; no read or DOM access. — js/background.js:36-43
Permissions are browsingData and notifications only; no activeTab, tabs, or scripting permission. — manifest.json:23-25
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
After the toolbar click it deletes all cookies, cache, and download-history entries from the beginning of time. It does not inspect or export the records first, but the deletion can sign the user out and erase the browser's download list.
Calls chrome.browsingData.remove with since: 0 and cache, cookies, and downloads all enabled. — js/background.js:36-43
The browser-wide deletion is reached only through a user click on the extension icon. — js/background.js:71-74
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
The only calls are browser localization, notification, action, browsing-data removal, timer, and tab reload APIs. — js/background.js:1-74
Contains no developer endpoint or externally supplied runtime resource. — manifest.json:1-38
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Names one packaged module service worker. — manifest.json:13-16
Contains the entire runtime and performs no network operation. — js/background.js:1-74
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
The cleanup routine contains the complete sequence of removal, notification, and reload. — js/background.js:29-69
The sole event listener invokes cleanup only on chrome.action.onClicked. — js/background.js:71-74
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Shows the full readable implementation in one source file. — js/background.js:1-74
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Both timers receive fixed arrow-function callbacks rather than strings. — js/background.js:23-26,55-58
Contains no dynamic code-generation primitive. — js/background.js:1-74
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
tab.id is passed to chrome.tabs.reload; no URL is read, stored, or sent. — js/background.js:60-63
No storage, analytics, or logging calls exist anywhere in the file. — js/background.js:1-74
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Complete file contains no storage, no ID generation, no fingerprinting logic. — js/background.js:1-74
No storage permission declared; only browsingData and notifications are requested. — manifest.json:15-21
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Uses the browser's bulk removal API without retrieving any record contents. — js/background.js:36-43
Contains no network request or data serialization. — js/background.js:1-74
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content_scripts array, no keyboard/clipboard/screenshot permissions declared. — manifest.json:15-21
No addEventListener for keydown, input, paste, or any DOM event; no chrome.clipboard or chrome.tabs.captureVisibleTab calls. — js/background.js:1-74
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The only listener is the browser toolbar click. — js/background.js:71-74
Declares no content scripts or externally_connectable origins. — manifest.json:1-38
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content_scripts declared; no programmatic injection via chrome.scripting. — manifest.json:15-21
No chrome.scripting.executeScript, no DOM access, no link or ad modification logic. — js/background.js:1-74
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Bulk-deletes the downloads browsing-data category along with cookies and cache. — js/background.js:36-43
Requests no webRequest, declarativeNetRequest, downloads, or proxy permission. — manifest.json:22-31
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No fetch, XMLHttpRequest, WebSocket, or any URL-based API call exists in the code. — js/background.js:1-74
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
No atob, eval, new Function, dynamic import, or encoded string execution present. — js/background.js:1-74
Only one background script declared; no additional JS files in the package inventory. — manifest.json:15-21
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes only img/*.png as web-accessible resources. — manifest.json:32-38
Provides no message receiver; cleanup is bound only to the toolbar click. — js/background.js:71-74
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Contains the sole fixed cleanup flow and click registration. — js/background.js:29-74
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
No Worker, OffscreenCanvas, intensive loops, or GPU-accelerated computation present. — js/background.js:1-74
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no content script or scripting permission. — manifest.json:1-38
Contains no page interaction beyond reloading the clicked tab after cleanup. — js/background.js:1-74