Is Smart Filters – protect and clean your links safe?

Low risk

Smart Filters downloads its URL-rewriting rules from smarturlcleaner.com every 30 minutes and installs them on all sites.

The extension is described as a tracking-parameter cleaner, but its full declarativeNetRequest ruleset is fetched from the vendor's server and installed as-is, so the vendor can change which requests are redirected, blocked or have headers modified on any site. Each refresh also sends the browser's language list, timezone, region hint and extension version to the same server, which also sees the IP address.

Smart Filtersv0.3.0Chrome Web Store
26Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Smart URL Cleaner installs a server-supplied request ruleset on all sites

Code analysis shows the extension downloads a rule list from smarturlcleaner.com every 30 minutes and installs it unchanged, with access to all sites.

The vendor can change what it blocks or redirects.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

Every 30 minutes the extension requests its rule list from smarturlcleaner.com.

The request carries version, language, timezone and region hints.

The extension did this

Whatever JSON array the server returns is installed as the browser's request rules.

Redirect, header-modify, block and allow-all actions are all permitted by the code.

The code that does this

Fetch, array check, and verbatim install

Readable version

Fetch and validation

service_worker.js
const l = await fetch(i, {headers: c, cache: "no-store", credentials: "omit"});if (!l.ok) throw new Error(`Fetch ${l.status}`);const d = await l.json();if (!d || !Array.isArray(d)) throw new Error("Malformed payload");...await applyRules(d)

Install step

service_worker.js
async function applyRules(e) {  for (const a of e) {    a.condition || (a.condition = {}), Array.isArray(a.condition.excludedRequestDomains) || (a.condition.excludedRequestDomains = []);    for (const e of CFG.SELF_EXCLUDE_HOSTS) a.condition.excludedRequestDomains.includes(e) || a.condition.excludedRequestDomains.push(e)  }  const a = (await chrome.declarativeNetRequest.getDynamicRules()).map((e => e.id));  await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: a, addRules: e })}
Values sent with each rule request
  • Extension version
    v=0.3.0

    Lets the server tailor the ruleset by release.

  • Language list
    primary_lang=en-US&langs=en-US,en

    Browser language preferences, usable to vary the ruleset.

  • Timezone and region
    tz=Europe/London&region_hint=US

    Coarse location hints that can vary the response.

When this fires

Every 30 minutes

The 'refresh' alarm re-fetches and reinstalls rules every 30 minutes, plus once at install.

Check if you're affected

Prints the dynamic rules the extension has installed, highlighting redirect and header-modifying actions.

Requires
  • Chrome with Developer mode
list_dnr_rules.js · js
// Lists the dynamic DNR rules currently installed by the extension.// Run in the extension's service worker DevTools console.const rules = await chrome.declarativeNetRequest.getDynamicRules();const kinds = {};for (const r of rules) kinds[r.action.type] = (kinds[r.action.type] || 0) + 1;console.log(rules.length, 'dynamic rules;', 'action types:', kinds);console.log(JSON.stringify(rules.filter(r => ['redirect','modifyHeaders','allowAllRequests'].includes(r.action.type)), null, 2));
How to run it
  1. 1Open chrome://extensions and enable Developer mode.
  2. 2Inspect the service worker.
  3. 3Paste the script in the console.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 0.3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Read and change your data on smarturlcleaner.com

    *://smarturlcleaner.com/*

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Smart Filters – protect and clean your links contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • smarturlcleaner.com

    Smart Filters – protect and clean your links sends data to smarturlcleaner.com. No other extension we have analysed sends data here.

Updated 15 October 2026nbgibbkdfoadimmhocheamohehhnhpmi