Is 360 Internet Protection safe?
We analyzed 360 Internet Protection version 2.1.60's actual code and gave it a 38/100 trust score. This extension has broad browser and desktop access,…
Bottom line
This extension has broad browser and desktop access, tracks browsing activity, and exposes a risky page-to-desktop bridge.
What it can access
It can run across every website, observe browsing activity, and communicate with desktop software, which is broader than a typical browser-only protection feature [Q1][Q12][Q19].
Security weaknesses
Selected websites can send unchecked messages that reach native functions, while the desktop side is unavailable for review [Q10][Q16][Q21].
Signs of misuse
It reports browsing activity to the desktop component and sends optional analytics by default, with site-specific behavior controlled externally [Q6][Q12][Q22].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access to every website plus tabs, scripting, native messaging, web requests, navigation, storage, alarms, and request-rule controls. Web protection needs substantial visibility, but this is effectively browser-wide access linked to a desktop application.
Declares <all_urls>, scripting, tabs, nativeMessaging, webRequest, webNavigation, storage, activeTab, declarativeNetRequestWithHostAccess, and alarms. — manifest.json:host_permissions and permissions
Uses these permissions to observe navigation and pass browser activity to the native host. — background.js:native event listeners
Which websites can it run on, and can it read or change what appears on those pages?
It runs at document start in every frame of every HTTP and HTTPS page. It injects toast UI, can override browser properties in the page's main world, and can expose a native helper function on selected sites.
Loads multiple scripts and CSS on http://*/* and https://*/* at document_start. — manifest.json:content_scripts
Injects main-world functions that change navigator values or add window.wdHelper. — background.js:overrideUserAgent and inject360Func
Adds extension-controlled toast elements to the current page. — toast/toast.js:Android_Toast.show
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Because its page access runs in every frame at document start, it is technically positioned to interact with pages containing passwords, payments, messages, or forms. The reviewed code does not read input values or scrape page content.
Grants code execution across all ordinary web pages and frames. — manifest.json:content_scripts
Handles explicit window messages but does not enumerate or read form elements. — wdsupport/wd_extension.js:message listener
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It observes current tab URLs, titles, tab creation/update/replacement/removal, committed navigations, history-state changes, and main-frame response statuses. It does not request Chrome cookies or bookmarks services.
Collects tab lifecycle and navigation data and sends it to the native host. — background.js:tabs, webNavigation, and webRequest listeners
Requests tabs and webNavigation but not cookies, history, or bookmarks. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It communicates with the separately installed 360 desktop application through native messaging. Native messaging can expose device-level capabilities beyond the browser; the external application's implementation is not included.
Declares nativeMessaging. — manifest.json:permissions
Connects to com.google.chrome.wdwedpro and exchanges structured commands and events. — background.js:connectNativeHost
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends browser activity to the local 360 desktop component, including page URLs, navigation types, tab lifecycle, page response status, active-tab title, and browser versions. It also submits sampled usage events to Google Analytics when privacy telemetry is enabled, which defaults to enabled.
Posts URLs and associated browser events to the native port. — background.js:callNativeHost variants and event listeners
Queues Google Analytics page-view and event telemetry when privacyPolicyChecked is true. — utils/stat_bg.js:trackPage and Stat.finish
Reads the privacy preference with a true default. — option/options.js:initPrivacyMsg
Does it download or run code, settings, or instructions supplied by a remote server?
The native application supplies protection state, anti-tracking configuration, an exclusion list, a website allowlist for native bridging, tab-refresh instructions, and other commands. A supplied script string is stored but not executed by the packaged code.
Applies native messages for refresh_tab, anti-track status, popup/protection state, toasts, and wd_helper initialization. — background.js:nativePort.onMessage
Stores nativeweb_list and nativeweb_script; only the list is referenced by webSupport. — wdsupport/wd_support.js:webInit
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The native component can instruct the extension to navigate a chosen tab to a supplied URL. The extension also automatically observes and reports navigation and modifies traffic when anti-tracking is active.
Calls chrome.tabs.update with native-supplied tabid and url. — background.js:Event.refresh_tab handler
Registers automatic listeners for tabs, navigation, and responses. — background.js:initBrowserEvent
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Modifies outgoing User-Agent headers outside excluded sites. — antitrack/headers.js:onBeforeSendHeaders
Overrides page-visible User-Agent and plugin values in all frames. — background.js:overrideUserAgent
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior lives in the external native application, including what wdHelper functions exist, what they can do, and how native-supplied website lists are chosen. Those security-critical details cannot be inspected in this extension package.
Forwards arbitrary function names and parameters to a native component not included in the package. — background.js:callNative and wd_helper handling
Native messaging makes the packaged extension only one side of the system. — manifest.json:permissions
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No text-to-code execution call was found. — *.js:dynamic-code review
Assigns webScript to wdHelper.web_script without using it elsewhere. — wdsupport/wd_support.js:webInit
Does it track the websites, pages, searches, or links you visit?
It systematically reports top-level URLs, navigation transitions, history-state changes, and tab activity to the local 360 desktop component. Anti-tracking mode also notifies that component of page hosts.
Forwards committed and history-state navigation URLs plus tab events. — background.js:procWebNavigation and initBrowserEvent
Calls the native host with the current request URL when anti-tracking applies. — background.js:Request.on_antitrack_inject
Does it create a persistent ID or browser fingerprint to recognize you?
Bundled legacy Google Analytics creates its normal persistent client identifier and sends sampled usage telemetry. Anti-tracking also generates a per-tab random User-Agent suffix, but that appears intended to reduce correlation rather than recognize the user.
Implements the packaged Analytics client and persistent tracking state. — utils/ga.js:Google Analytics client
Submits configured account, page-view, and event records. — utils/stat_bg.js:trackPage and gaPush
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request the cookies permission. — manifest.json:permissions
Sends URLs and metadata but no extracted credentials or request bodies. — background.js:navigation and request forwarding
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no clipboard, capture, camera, or microphone capabilities. — manifest.json:permissions
Forwards explicit bridge messages and does not register keyboard or form listeners. — wdsupport/wd_extension.js:entire file
Can a website or remote server send commands that make the extension take actions?
Both the native component and selected websites can trigger privileged behavior. Native messages can redirect tabs and change protection state; any script on a native-selected site can send arbitrary named functions and parameters through the extension to the native component.
Accepts native commands including refresh_tab and wd_helper configuration/results. — background.js:nativePort.onMessage
Forwards wd_extension messages without checking event source or origin. — wdsupport/wd_extension.js:window message listener
Passes sender URL, arbitrary func, and parameter to the native host. — background.js:Request.on_wd_helper_support
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds status UI but does not rewrite existing links or commerce data. — toast/toast.js:toast rendering
No affiliate substitution or search-result editing path was found. — *.js:link and shopping review
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
Anti-tracking mode modifies the User-Agent request header across web traffic and overrides browser properties visible to pages. It also observes main-frame response headers/statuses.
Appends a random suffix to User-Agent except for excluded tabs/sites. — antitrack/headers.js:chrome.webRequest.onBeforeSendHeaders
Forwards main-frame response URL/status details to the native host. — background.js:webRequest.onHeadersReceived
Can it communicate with software on the computer or services running on localhost?
It maintains a native-messaging connection to com.google.chrome.wdwedpro and sends commands, browsing events, and selected-site bridge calls to that desktop application.
Connects to and posts messages to the named native host. — background.js:connectNativeHost and callNative
Declares nativeMessaging. — manifest.json:permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Injects fixed packaged function objects rather than decoded code. — background.js:executeScript calls
No decoded value reaches an execution sink. — *.js:decoder-to-execution review
Can ordinary websites access privileged extension features through messaging or exposed files?
On websites selected by the native component, ordinary page scripts receive window.wdHelper and can send arbitrary function names and parameters to the native application. The window-message relay does not verify event.source or origin.
Installs window.wdHelper in the page's MAIN world. — background.js:inject360Func
Relays any wd_extension-shaped page message to privileged runtime messaging. — wdsupport/wd_extension.js:window.addEventListener('message')
Enables the bridge when the current host contains an entry supplied by the native component. — background.js:wdHelper.webSupport
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The native component remotely selects which websites receive the page-to-native bridge and supplies anti-tracking exclusions and state. This creates behavior that may differ by site and by external configuration unavailable in the package.
Consumes native-supplied website lists and exclusions. — background.js:Event.wd_helper and AntiTrackStateChanged
Activates support only when a URL contains a native-provided list entry. — wdsupport/wd_support.js:webSupport
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is event-driven navigation, native messaging, UI, and analytics logic. — *.js:resource-use review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates extension-owned toast elements without selecting forms or inputs. — toast/toast.js:toast construction
No form, input, submit, or action-rewrite behavior was found. — *.js:form review