The extensiveness of Google's Chrome Cleanup Tool (CCT) seems to have caught some users off-guard, raising some concerns after IT Security expert Kelly Shortridge noticed the tool scanning files on her computer. Specifically, Shortridge noted that the utility had scanned files in the Documents folder on her Windows machine and took to Twitter to relay her concern that it may be collecting data. For those who may not recall, CCT was actually included as an integral part of Chrome back in 2017. It works as a kind of an antivirus solution, scanning files that may be linked to malicious extensions or software. The concern expressed by Shortridge and – later – others seems to have primarily centered around whether or not Google is collecting that data in any fashion.
While that question appears to be valid given the number of privacy concerns being raised in light of Facebook's recent scandals, it may actually be a bit premature to start panicking about Google's CCT. As explained to Shortridge by Google security team lead Justin Schuh, nothing that is scanned ever leaves the system and none of those files or their contents ever get pushed to the cloud. In fact, he says that the only purpose of the scans is to keep an eye out for files that may be malicious to Chrome itself or the data stored in Chrome. It hence effectively acts as a very narrow-minded antivirus tool. Coupled with other features the company has introduced and is working on introducing, the chief concern here appears to be ensuring privacy rather than figuring out if it has been breached because it hasn't.
Whether or not CCT can be highjacked or used maliciously by other entities is another matter but that hasn't happened yet and it doesn't seem to be something that would be easy to accomplish. So, the remaining concern seems to be why so many Chrome users weren't aware of it in the first place. This is a core feature and, as such, there's really no way to turn it off or opt out, as of this writing. The security team, according to Schuh, has been working on allowing opt-out options but needs to balance them against a "potential for abuse." Google may need to find a way to be more transparent about the inclusion and use of the tool when users are installing the browser, some users have suggested.