Volume Booster (2M Chrome users) silently activated a commerce-tracking SDK with zero permission prompts

Diffed Volume Booster's last three versions (1.0.2 → 1.0.4).

https://chromewebstore.google.com/detail/volume-booster/ejkiikneibegknkgimmihdpcbcedgmpo

• <all_urls> host permission was granted in 1.0.2 and sat unused.
• webRequest was added in 1.0.3.
• The actual tracking SDK (Give Freely / Wildfire affiliate network) landed in 1.0.4, no new permissions requested, so Chrome pushed it silently to the existing 2M weekly users with no re-consent prompt.

Full writeup, manifest diffs, and repro steps: https://malext.io/reports/QuietBoost