What our analysis found

Kaspersky Protection, used by 19,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests. It comes from a publisher with 6 extensions and was last updated in September 2026.

This is the legitimate Kaspersky Protection browser extension — a well-known security product that acts as a bridge between the Chrome browser and the locally-installed Kaspersky AV application via native messaging. All sensitive data flows (password MD5 hashes in:58, base64-encoded usernames in:192, URL lists in:341) route exclusively through chrome.runtime.connect('content_transport') → background service worker → nativeMessaging to the local Kaspersky process; no direct external network calls exist in the extension code. Every data category observed (authentication information via compromised account check, web history via monitoring, website content via DOM parsing) is explicitly disclosed in the CWS privacy declarations. The bundled manifest matches the published manifest exactly with no discrepancies. The ML score of 0.00 and chrome-stats likelihood of both corroborate the benign verdict; the risk-engine flags are driven by the broad permission set that is inherently required for a security product of this type.