Is Cleaner - history & cache clean safe?
We analyzed Cleaner - history & cache clean version 1.1.33's actual code and gave it a 38/100 trust score. This cleaner has purpose-related access but…
Bottom line
This cleaner has purpose-related access but also tracks installations and can open server-chosen pages without clear user action.
What it can access
It can clean cookies, history, downloads, passwords, and other browser data, while running on every website; this is powerful but related to its stated purpose [Q1][Q4].
Security weaknesses
A server-controlled address is opened without an allowlist or confirmation, allowing unwanted navigation if that service is compromised or misused [Q16].
Signs of misuse
It reports a persistent installation ID during lifecycle events and can open promotional or other pages without a user click [Q13][Q17].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests browsingData, cookies, tabs, alarms, storage and all-site access. Most access supports its advertised manual, filtered and scheduled cleaning, but exposing every packaged resource to every site and loading a page access everywhere are broader than necessary.
Loads a content script on all sites, declares browsingData/cookies/tabs/alarms, grants all-site host access and exposes every resource to all sites. — manifest.json:31-65
Offers explicit controls for cleaning cache, cookies, downloads, history, storage, form data and passwords on a schedule. — options.html:1
Which websites can it run on, and can it read or change what appears on those pages?
A page access runs on every ordinary website. It does not read page text or form values; when the user enables the floating-button setting, it appends a visible clear button and can append an audio element after cleaning.
Injects content.js and content.css on every HTTP/HTTPS page. — manifest.json:31-43
Creates only the opt-in clear-button image and completion-audio element, then sends an internal clearBtn message on click. — js/content.js:1
Labels the disabled-by-default option as a floating Smart Clean button on all pages. — options.html:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Its permissions let it delete saved passwords, form data, cookies and local storage after the user selects those categories. The reviewed code removes data through Chrome services; it does not read or send password values, typed text or page contents.
Provides visible selectors for cookies, local storage and passwords. — popup.html:1
Explains that password and form-data choices delete stored records. — options.html:1
Passes selected category flags to chrome.browsingData.remove without first retrieving the underlying values. — js/background.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can delete cookies, browsing history, download history and other browser data. With domain filters it enumerates cookies only to remove matching or non-exempt entries.
Declares browsingData, tabs, cookies and all-site host access. — manifest.json:47-55
Calls browsingData.remove and uses cookies.getAll/cookies.remove for the configured include-or-exclude domain filter. — js/background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no clipboard, geolocation, capture, camera, microphone, file-system or native-messaging permission. — manifest.json:47-55
The File Systems choice is one chrome.browsingData removal category, not a local-file picker or reader. — options.html:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
On install and update it sends the extension ID/version, lifecycle action, persistent random UID and timestamp to smartcleaner.online. Uninstall sends the same fields through the browser's uninstall URL.
Builds Base64-encoded lifecycle payloads and sends them to http://smartcleaner.online/api/action/; configures an HTTP uninstall URL with the same identifier fields. — js/background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The SmartCleaner action server supplies a URL that the extension opens automatically on install or update. This is an active remote instruction path, but it opens an ordinary tab; it does not download JavaScript or pass server text to an execution primitive.
processQueue parses the action endpoint's JSON and calls chrome.tabs.create when response.url is present. — js/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Manual clearing is user-invoked, scheduled cleaning is opt-in and no categories are selected by default. Password clearing receives confirmation; other selected categories can be erased immediately.
Initializes dataToRemove empty and timeInterval off, then uses user settings for manual or alarm-based deletion. — js/background.js:1
Shows a confirmation dialog before clearing passwords, but directly clears other selected categories. — js/popup.js:1
Automatically processes lifecycle events and opens a returned action-server URL. — js/background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no search, homepage, proxy, privacy or browser-settings permission. — manifest.json:47-55
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Extension scripts are minified onto single lines but retain readable property names, literal services and coherent behavior. Bundled jQuery is the main third-party component.
Lists four small application scripts and bundled jQuery/UI assets. — inventory.json:1
Exposes lifecycle URLs, UID fields, cleaning calls and listener names as readable literals despite minification. — js/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Handles remote action JSON only as a URL for tabs.create. — js/background.js:1
Uses jQuery for local popup events and styling, not Ajax or script loading. — js/popup.js:1
Uses jQuery for local settings UI, not remote script execution. — js/options.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Contains only floating-button, audio and internal-message behavior; it never reads location, title or page text. — js/content.js:1
Lifecycle payload contains extension ID/version, action, UID and timestamp only. — js/background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It generates and permanently stores a random UID, then reports it with install, update and uninstall events. This supports cross-event tracking of one installation.
generateUID creates config.uid, saveConfig persists it, and lifecycle/uninstall payloads include uid. — js/background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Constructs remote lifecycle payloads from id, version, action, uid and time, while cookie objects flow only to chrome.cookies.remove. — js/background.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Does not attach keyboard, input, submit, clipboard or capture listeners. — js/content.js:1
Presents Form Data as an explicit browser-data removal category. — options.html:1
Can a website or remote server send commands that make the extension take actions?
SmartCleaner's HTTP action services can cause the extension to open any URL it returns after install or update. There is no allowlist, protocol validation, confirmation or disclosure in this code path.
Fetches the HTTP action endpoint, trusts response.url without validation and passes it directly to chrome.tabs.create. — js/background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The server-controlled navigation mechanism can open promotional, affiliate or other webpages without a click. The package does not reveal the current destination, so unwanted promotion is strongly supported as a capability while a specific abusive destination is not demonstrated.
Automatically opens the arbitrary URL returned for install/update lifecycle actions. — js/background.js:1
Separately prompts for a Chrome Web Store review after 25 interactions; that visible prompt opens the review page only after consent. — js/options.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, webRequest, declarativeNetRequest or downloads API permission. — manifest.json:47-55
Explains that clearing Downloads removes the list but not actual files. — options.html:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission; the only application endpoint is public smartcleaner.online. — manifest.json:47-55
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses btoa for JSON lifecycle metadata and treats response.url as navigation, not code. — js/background.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes resource wildcard * to all HTTP/HTTPS sites. — manifest.json:57-65
Receives chrome.runtime messages and sends a fixed internal clearBtn action only from its own optional button; it has no page message bridge. — js/content.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Remote navigation activates specifically on install and update lifecycle events, while uninstall tracking activates at removal. This selectivity is explicit in code rather than hidden by dates, locales, account targeting or remote feature flags.
Queues chrome.runtime.onInstalled reason values and configures a distinct uninstall action URL. — js/background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Alarm events call the same configured browsingData removal routine used by manual cleaning. — js/background.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Contains no form query, input listener, submit handler or action rewrite. — js/content.js:1