Is History & Cache Cleaner safe?
We analyzed History & Cache Cleaner version 3.0.0's actual code and gave it a 82/100 trust score. This appears purpose-aligned, but it has powerful…
Bottom line
This appears purpose-aligned, but it has powerful permission to delete sensitive browser data.
What it can access
It can delete cookies, history, saved passwords, cache, and other browser data, matching its cleaning purpose but affecting sensitive information.[Q1][Q4]
Security weaknesses
No meaningful weakness is shown: websites lack a demonstrated path to control the extension or reach its privileged actions.[Q2][Q16][Q21]
Signs of misuse
There is no evidence of tracking, outside data sharing, remote commands, or hidden resource use; installation only opens a vendor welcome page.[Q6][Q7][Q12][Q23]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests browsingData and cookies so it can delete browser history, cache, cookies and other user-selected categories. It has no all-site host access or active page access.
Declares activeTab, storage, browsingData and cookies. — manifest.json:19-24
Loads only the background worker; no content_scripts entry is present. — manifest.json:4-6
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts declaration and no scripting permission. — manifest.json:1-44
Packaged button code is not referenced by the manifest or active entry points. — js/content.js:1-65
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Offers saved passwords as a user-selectable deletion category. — options.html:129-135
Passes selected category booleans to chrome.browsingData.remove without reading their contents. — js/background.js:102-118
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can delete history, cache, cookies, download history, form data, saved passwords and site storage. This destructive access is the advertised feature.
Lists the browser-data categories the user may select for removal. — options.html:32-145
Converts selected categories into chrome.browsingData.remove arguments. — js/background.js:102-116
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does not request downloads, clipboard, file or media-capture permissions. — manifest.json:19-24
The downloads checkbox is a browsing-data deletion category. — options.html:73-79
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Performs local storage reads, deletion APIs and optional tab reload only. — js/background.js:1-140
Opens a static vendor welcome page on first install and registers an uninstall URL. — js/welcome.js:7-20
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Imports only packaged welcome and background scripts. — js/bg-worker.js:1-2
Uses only locally stored user settings and browser APIs. — js/background.js:1-140
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically opens its vendor welcome page once after installation and sets an uninstall URL. Browser-data deletion itself requires the popup action.
Checks for reason=install before opening /welcome; always registers /uninstall. — js/welcome.js:7-20
The Clear button sends the deletion request. — js/popup.js:4-17
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy or browser-settings permissions. — manifest.json:19-24
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive functions and direct Chrome API calls. — js/background.js:1-140
Identifies itself as the standard jQuery 3.4.1 distribution. — js/jquery.3.4.1.js:1-13
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Defines jQuery's generic DOMEval helper. — js/jquery.3.4.1.js:98-125
Loads only packaged jQuery, localization and popup scripts. — popup.html:50-54
Uses function callbacks for timers and makes no AJAX or script-loading calls. — js/popup.js:1-129
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Invokes the aggregate browsingData.remove API without reading history records. — js/background.js:102-118
History is a user-selected deletion category. — options.html:97-103
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The worker loads only the packaged welcome and deletion logic. — js/bg-worker.js:1-2
Contains no identifier generation or network request. — js/background.js:1-140
Does it send cookies, session details, authentication data, or page contents elsewhere?
It can enumerate cookie records and delete them according to user-created filters. Cookie values are not stored or sent anywhere.
Calls cookies.getAll for selected domains or all domains, then removes matching cookies by name and domain. — js/background.js:65-99
Stores only inclusion mode and domain filters locally. — js/options.js:117-179
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no content script or capture permission. — manifest.json:1-44
Handles only extension popup controls. — js/popup.js:1-129
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Has no externally_connectable declaration or remote script entry. — manifest.json:1-44
Internal messages support only clear and clearBtn actions. — js/background.js:18-29
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Contains optional button insertion code, but it is unreachable from active package entry points. — js/content.js:13-24
Declares neither content scripts nor scripting permission. — manifest.json:1-44
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest or proxy permission. — manifest.json:19-24
Opens only the manifest homepage's welcome/uninstall paths. — js/welcome.js:7-20
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:19-24
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Imports only packaged scripts. — js/bg-worker.js:1-2
Loads only packaged scripts. — popup.html:50-54
Loads only packaged scripts. — options.html:175-179
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable entry and no active content script. — manifest.json:1-44
Handles a small internal action list. — js/background.js:18-29
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads and writes the user's deletion settings in chrome.storage.local. — js/options.js:64-123
Builds the deletion operation from those settings. — js/background.js:102-118
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Implements only browser-data clearing and optional tab reload. — js/background.js:1-140
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or scripting permission allows page-form modification. — manifest.json:1-44
The inactive packaged script only creates a clear button and does not inspect forms. — js/content.js:1-65