Volume Booster (2M Chrome users) silently activated a commerce-tracking SDK with zero permission prompts
Source Reddit NetSec
Discussion
The Volume Booster Chrome extension, with approximately 2 million weekly users, silently activated a commerce-tracking SDK (Give Freely) between versions 1.0.2 and 1.0.4 without triggering Chrome's permission re-consent prompt. The extension had previously been granted broad host permissions that were dormant until the SDK was activated. This SDK collects device identifiers, geolocation data, and telemetry continuously, regardless of user interaction with the extension's visible UI. The Chrome Web Store listing's privacy declaration does not disclose these data flows, creating a discrepancy between declared and actual behavior.
r/netsec (opens in a new tab)u/Huge-Skirt-69900 points0 comments
Diffed Volume Booster's last three versions (1.0.2 → 1.0.4).
-
<all_urls>host permission was granted in 1.0.2 and sat unused. webRequestwas added in 1.0.3.- The actual tracking SDK (Give Freely / Wildfire affiliate network) landed in 1.0.4, no new permissions requested, so Chrome pushed it silently to the existing 2M weekly users with no re-consent prompt.
Full writeup: https://malext.io/reports/QuietBoost