2026-06-21 tracking QuietBoost - Volume Booster extension: Silent Activation of a Commerce-Tracking SDK on Pre-Granted Permissions Target Field Value Extension Name Volume Booster Extension ID ejkiikneibegknkgimmihdpcbcedgmpo Version Analyzed 1.0.2 → 1.0.4 Install Count ~2,000,000 weekly active users (confirmed present since 2025-01-05) Executive Summary Volume Booster is a Chrome extension with roughly 2 million weekly users, present since at least January 2025. Between versions 1.0.2 and 1.0.4, the developer activated a commerce-tracking and affiliate-monetization SDK (Give Freely, built on the Wildfire affiliate network) without ever triggering Chrome's permission re-consent flow. This was possible because the host permission the SDK depends on ( all_urls ) was already present in version 1.0.2, granted but unused. This report documents the deployment mechanism and the resulting gap between the extension's privacy declaration and its actual data flows. Give Freely's monetization model itself (affiliate commissions, partly donated to user-selected charities) is a real, identifiable business. Several of its practices are not in dispute and are addressed directly in "What This Report Does Not Claim." Scope This report evaluates Volume Booster's deployment practice, specifically how a third-party SDK was activated without user consent. It is not an audit of Give Freely or the Wildfire affiliate network as a vendor. Give Freely presents itself publicly as a charity-funded affiliate platform with disclosed practices (no overwriting of existing affiliate attribution, commission donated to user-selected charities); we have not independently verified Give Freely's claims about its own operations, financials, or conduct across its full partner network. Findings here are limited to what Volume Booster's specific integration does and how it was disclosed, not to Give Freely's trustworthiness as a company. Methodology & Discovery The investigation began with a routine review of Volume Booster following the integration of Wildfire/GiveFreely-pattern fingerprints into the malext.io detection pipeline. Pulling the extension's version history (1.0.2, 1.0.3, 1.0.4) and diffing each manifest and bundle revealed a staged sequence: a dormant broad host permission, followed by an observability permission, followed by the monetization payload itself, each shipped as a separate, low-attention update. Cross-referencing the Chrome Web Store listing's first Wayback Machine capture (2025-01-05) against the version timeline confirmed the 2M-user base predates all three versions under analysis. This rules out the possibility that the userbase was grown through, or as a result of, the monetization SDK. Version Timeline Version Date Size Change 1.0.2 2025-06-10 25.32 KB all_urls host permission present; unused 1.0.3 2025-06-27 25.54 KB Adds webRequest ; adds a debug-gated console logger 1.0.4 2025-07-02 55.25 KB Adds Give Freely content script and SDK init Manifest Diffs 1.0.2 → 1.0.3: "unlimitedStorage", - "windows" + "windows", + "webRequest" ], 1.0.3 → 1.0.4: "background": { "service_worker": "service-worker.js" }, + "content_scripts": [ + { + "matches": [ "<all_urls>" ], + "js": [ + "vendor/GiveFreely-content.umd.js", + "content-script.js" + ] + } + ], "icons": { host_permissions ( all_urls ) is unchanged across all three versions. No permissions or host_permissions entry changes between 1.0.3 and 1.0.4, only the content script is added, so this update triggered no re-consent prompt. Architecture: Staged Activation on Dormant Permissions The extension's permission and code history shows three distinct phases: Dormant grant (1.0.2): all_urls is requested and granted, but no code in this version reads or acts on network traffic. Observability (1.0.3): webRequest is added, backing a vmdebug -gated console logger of media requests. This is the first code to exercise the previously dormant host permission. Monetization (1.0.4): A vendored Give Freely SDK is added as an all-sites content script, initialized in the background service worker: self.importScripts('vendor/GiveFreely-background.umd.js'); const giveFreely = new GiveFreely.GiveFreelyService('volumeboosterprod'); void giveFreely.initialize(); Because the host permission required by phase 3 was acquired in phase 1, and no permission entries changed in phase 3, the SDK went live across the existing 2M-user install base with no Chrome permission warning and no user action. Undisclosed Behavior: Commerce Tracking SDK Once initialized, and independent of any popup or UI state, the SDK: Matches navigations against a cached Wildfire merchant list and opens a hidden, pinned tab to wild.link to set attribution cookies on matches Geolocates the user via geoip.maxmind.com , authenticated with a hardcoded MaxMind credential (account 913991 ) Registers a persistent anonymous device ID with Wildfire and a user record with api.givefreely.com Sends device-keyed event telemetry to events.givefreel...