Worth a MalExt Report? A 2 Million-User Chrome Extension Added Give…

I've been reversing the 2M+ user Volume Booster Chrome extension and found something interesting.

Between v1.0.3 (2025-06-27) and v1.0.4 (2025-07-02), the extension added:

"content_scripts": [{ "matches": ["<all_urls>"], "js": [ "vendor/GiveFreely-content.umd.js", "content-script.js" ] }]

The previous version was essentially a small audio booster. The newer version introduces a Give Freely / Wildlink component that appears to support merchant detection, affiliate attribution, and donation campaigns.

No new permissions were added, meaning existing users would have received the update automatically without a new Chrome permission approval prompt.

I've also found the same Give Freely / Wildlink infrastructure in multiple unrelated extensions, which makes me think it's being distributed as a white-label monetization/fundraising SDK.

I'm still investigating and considering whether this is worth adding to MalExt. At this point I don't have evidence of malware, credential theft, or anything overtly malicious just a significant expansion of functionality in a 2M-user extension.

Curious what others think. Is this a transparency/privacy concern, or just a normal extension monetization model? Any opinions or prior research on Give Freely / Wildlink would be appreciated so i can added to malext.io

Impact

The extension's update introduces affiliate tracking and donation campaign capabilities without new permission prompts, potentially impacting user privacy and transparency. There is no confirmed malicious activity or exploitation. Users may be unaware of the new data collection and affiliate attribution behaviors introduced by the update.

Defensive guidance

Users concerned about privacy or transparency should consider reviewing extension updates carefully and potentially disabling or removing extensions that introduce unexpected functionality. Security teams should monitor for further research or reports regarding this SDK and its privacy implications.

Summary

Between versions 1.0.3 and 1.0.4 of the Volume Booster Chrome extension, a new content script related to Give Freely/Wildlink was added. This script supports merchant detection and affiliate attribution, likely for monetization or fundraising purposes. No new Chrome permissions were requested, so existing users received the update silently. The same Give Freely/Wildlink component is found in multiple unrelated extensions, indicating it is distributed as a white-label SDK. There is currently no evidence of malicious activity such as malware or credential theft. The update represents a significant functional expansion that may raise privacy or transparency concerns.

Worth a MalExt Report? A 2 Million-User Chrome Extension Added Give Freely/Wildlink in a 5-Day Update

Discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

AI analysisMachine-generated, updated 17 Jun 2026, 20:49 UTC

Technical details

References

Community reviews

Related threats