What our analysis found

360 Internet Protection, used by 19,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in December 2025.

360 Internet Protection is a legitimate browser companion for Qihoo 360's desktop antivirus product. Every behavior observed in source is consistent with the stated purpose: visited URLs are relayed to the locally installed native host (`com.google.chrome.wdwedpro`) for cloud lookups, the anti-tracking module modifies User-Agent headers as a privacy feature (opt-in, disabled by default at `AntiTrack.enable_antitrack = false`), and ` ` is the stock Google Analytics library used for product telemetry — accounting for most of the ML pattern hits (minified exclamation marks, encoded strings, script injection). No data exfiltration to unknown third parties was found; the explicitly only contacts ` ` via the native application, not directly from the extension. The ML score of 0.00 and a clean permhash cluster (0% malware peers) corroborate the benign read. The third-party `removed-from-store` flag and the broad permission set are the only concerns, but neither indicates malice.