UC Browser

Is UC Browser safe?

Not very. UC Browser has more than a billion downloads on Google Play, but it scores 39/100, the lowest of the browsers we have rated and far behind Opera (67) and Google Chrome (59). Its own Google Play label says data "isn't transferred over a secure connection". Apple's label says location and device identifiers are used to track you across other companies' apps and sites. Researchers have reported serious privacy or security flaws in it three times since 2015, and India has blocked it since June 2020. If you use it for anything you would not want an advertiser or a stranger on public Wi-Fi to see, switch.

What data does UC Browser collect?

A lot, and much of it is tied to you. The App Store privacy label for the iPhone app has a "Data Used to Track You" section covering location and identifiers. Under data linked to you it lists precise and coarse location and a device ID used for third-party advertising and UCWeb's own marketing, plus purchase history, search history, a user ID, product interaction and advertising data for analytics and personalisation.

The Google Play label for the Android app lists web browsing history, device IDs, user IDs and crash data, and says no data is shared with other companies. The privacy policy, last updated on 10 April 2025, says otherwise: UC Browser "is connected to certain advertisement platforms including AdMob by Google, Facebook Audience Network, and Intowow" and "may share device information and network information" with them. It also lets UCWeb pass data to Alibaba-group affiliates and asks you to consent to your data being stored "outside of the country where you live". The label understates the policy, so we score privacy on the policy.

Why do security researchers keep flagging it?

UC Browser has a long record of findings by outside researchers.

In May 2015 the University of Toronto's Citizen Lab found that the Android app leaked subscriber and device identifiers, location and search queries over unencrypted or weakly encrypted connections, so anyone on the network could read them. The research started from a leaked 2012 document showing that Canada's signals intelligence agency knew of the weaknesses. That is more than ten years ago, so it does not count in our score, but the pattern continued.

In March 2019 the Russian antivirus firm Doctor Web reported that the Android app could download and run extra code modules from UCWeb's servers, bypassing Google Play, a feature it said had been present since at least 2016. Because the requests went over plain HTTP and the modules were not signed, an attacker on the same network could swap in malicious code. Doctor Web said it had not seen the feature used to spread malware.

In June 2021 researcher Gabi Cirlig, with two others checking his work for Forbes, found the browser sending records of every site visited back to its servers, even in Incognito mode, together with the user's IP address and an ID that could link those visits.

The current Google Play label still says data is not encrypted in transit. Alibaba runs a bug bounty on HackerOne, but its listed scope covers Alibaba, AliExpress, Taobao, Lazada and other sites, not UC Browser, and we found no other public program for the app.

Why is UC Browser banned in India?

UC Browser was once one of the most popular mobile browsers in India. On 29 June 2020 the IT ministry blocked it with TikTok and 57 other apps, using its emergency powers under section 69A of the IT Act. The order cited "reports about misuse of some mobile apps... for stealing and surreptitiously transmitting users' data in an unauthorized manner to servers which have locations outside India". UCWeb was not fined, and the order did not set out findings about each app. The block is still in place: the app is missing from India's App Store in October 2026.

How to stay safe if you still use UC Browser

1. Do not log in to banking, email or work accounts in UC Browser. Use a browser that encrypts its own traffic and patches quickly.
2. Never use it on public Wi-Fi without a full device VPN. Both the 2015 and 2019 findings turned on unencrypted traffic.
3. On iPhone, deny precise location and tap "Ask App Not to Track" when the app asks.
4. Do not create a UC account unless you need it; the browser works without one.
5. Install apps only from Google Play or the App Store. Modified UC Browser files from other sites add their own risks.

How we scored it

Privacy (28) is the weakest factor, because of tracking with location data on Apple's label and ad-network sharing in the policy. Security (35) is low because UCWeb's own label says data is not encrypted in transit and researchers have found unsafe code loading and Incognito leaks. The regulatory record (58) reflects India's 2020 block, which cited data sent abroad. For a safer browser on Android, see Samsung Internet or Brave.