Kudos, a shopping extension powered by Wildfire, in its current version invites users to “auto-activate Boost”—at which point any click, even Dismiss, invokes an affiliate link. This is a bad deal for merchants, who pay commissions for things users would have bought anyway. Plus it violates rules from applicable affiliate networks, which only allow shopping extensions to invoke affiliate links when users actually click. In a particularly brazen twist, this feature shipped for everyone—first, un-disablable; later, on-by-default—for more than eleven months, and Kudos only changed the setting to off-by-default when I and others caught competing shopping extension Phia with a similar violation.
Kudos’ current practice
(This section describes Kudos’ practice as of October 16, 2026, when I posted the first version of this article.)
When a user installs Kudos, a post-install screen invites a user to “Auto-activate boost.”
The user can also turn on “Auto-activate Boost” from the Kudos settings screen. A mouseover bubble repeats text from the post-install screen.
In a representative test, with Auto-activate Boost turned on, I requested temu.com. A Kudos window appeared, proposing that I “Activate extra earnings” or “Activate & close”. I instead clicked “Dismiss”. Kudos opened a new tab invoking Kudos’ affiliate link to Temu, and when that tab finished loading, Kudos closed it. Video. I saw the same behavior when clicking elsewhere, for example on the “Exclusions Apply” link.
While my screenshots and video show Kudos practices on Chrome on a desktop PC, Kudos’ Safari Mobile extension has the same Auto-activate Boost setting. On Safari Mobile, Kudos’ new tab opens invisibly to the user (versus flashing briefly in the tab bar on Chrome for desktop). As I demonstrated for Phia in July, a user can reveal the invisible window by opening Safari’s tab-switcher with excellent timing—though normal users would have no reason to attempt that, not to mention get the timing just right.
Initially, on for everyone, with no off switch
Kudos first shipped an auto-click feature in version 4.211.5. As of that version, a click substantially anywhere in Kudos’ popup triggered Kudos’ affiliate link. The clickable area included whitespace, links labeled “Exclusions apply” and “View list of exclusions and rates”, the minimize button (“_”) sometimes shown in the top-right corner, and even the pipe separator (“|”) sometimes shown as a separator between user interface elements in Kudos windows. To confirm and preseve this behavior, I installed Kudos 4.299.2. I requested Temu, clicked whitespace, and got a Kudos affiliate link. See Video — note version confirmation at 0:01, click at 0:15, and new tab visible from 0:15 to 0:18, then auto-close by Kudos.
In my testing, the only portion of the Kudos popup that did not invoke the affiliate link was the top-left icon and Kudos branding, which instead opened a new tab to joinkudos.com.
In addition to hands-on testing, I checked Kudos extension source code (shown below after pretty-printing to restore line breaks). Like most extensions, Kudos is minified, but its original name survives when tagged as a DisplayName (yellow).
ste=Uo(ate).withConfig({displayName:"ExtensionWrapper", ...
Then a separate procedure sets ste’s onClick handler to the function minified as A (blue):
ste,
{
onClick: A,
tabIndex: 0,
ref: (e) => u(e),
isExpanded: l, ...
Click-handler A passes execution to D5 (grey) which eventually passes execution through to a chrome.tabs.create() with active set to false and index set to 0 (red), yielding a non-focused new first tab.
const A = (0, sr.useCallback)( async (e) => { e.preventDefault(); const n = await D5(t, r); // t = merchant, r = page type await n?.activate(), ... n = await chrome.tabs.create({ url: t, active: !1, index: 0, });
The code to auto-close the affiliate tab is adjacent. When the affiliate tab completes loading (orange), Kudos closes it (pink):
chrome.tabs.onUpdated.addListener((t, r) => { "complete" === r.status && t === n.id && (chrome.tabs.remove(n.id), e(!0));
I spot-checked Kudos extensions from version 4.211.5 through and including 4.307.3. I studied minified HTML and JavaScript to confirm that these are similar in relevant respects.
Later, turned on by default
From version 4.308 through version 4.520.0, Kudos pre-activated the Auto-activate Boost setting. In this period, the Boost settings screen (popup.js) got the value for the Auto-activate Boost setting from code that treated the setting as on by default
[u,d] = useState(e?.preferences?.disableAutoBoostActivation ?? null) y = u ?? false v = !y ... createElement(Pfe, null, "Auto-activate Boost", ...), ... isOn: v, onChange: k
If the user never touched the setting, u would be null, which would make y false, so v (set to not y) would be true, and the Auto-activate Boost setting in the settings screen would be set to isOn=true.
Kudos’ auto-activate code followed much the same logic. From container.js:
y && !0 !== t?.preferences?.disableAutoBoostActivation
Here, y denotes whether the merchant supports Kudos’ Boost benefits (unrelated to the variable y from the prior code snippet). !0 is always true. With true on the left, the !== operator evaluates to true when the right side is anything other than true. If the right side is null, undefined, or false (such as for a user who left the Auto-activate setting at its default), the right side will not equal true, so the overall expression will evaluate to true and Kudos will proceed with the automatic click.
Timeline
July 29, 2025 (version 4.211.5): Kudos began forcing clicks—making its entire popup (even the minimize button) invoke the affiliate link.
December 18, 2025 (version 4.308.0): Kudos gave the automatic clicks a user-facing name (“Auto-activate Boost”) and a user interface element pre-activated by default. For a user who did not change the setting, behavior remained as in 4.211.5. But users gained the ability to turn the automatic clicks off by request.
July 17, 2026 (version 4.527.2): Kudos reversed the default, turning Auto-activate Boost off unless a user turned it on. That’s eight days after I revealed shopping extension Phia forcing clicks. The best interpretation is that Kudos realized it was likely to get caught as I or others continued testing more shopping extensions.
October 16, 2026 (version 4.657.0): I posted the first version of this article, revealing Kudos’ 4.308 (Auto-activate Boost user interface, on-by-default) and 4.527 (Auto-activate Boost off-by-default). The same day I posted, Kudos removed the Auto-activate Boost feature.
***
Rakuten policies require that an extension maker “notify us [Rakuten] in writing” about any “revision” of an extension. I’d like to see evidence that Kudos and Wildfire actually did what this rule requires—a particularly important step for material revisions such as making the entire window (including whitespace and minimize button) a link, offering an automatic click setting, or turning on automatic clicks by default.
Contracts and policies on point
The prohibition on automatic clicks is a network rule, designed to increase the incrementality of affiliate traffic and protect merchants from undue expense.
Relevant contract provisions:
- CJ Publisher Service Agreement: “Software may not be used to force clicks [or] perform redirects without an affirmative click by a user”.
- Rakuten Affiliate Network Policies: “The DSA [downloadable software application] must not force clicks or ‘cookie stuff’. The DSA must not insert a cookie onto the user’s computer without the user knowingly taking an action. … The only way the Supplier cookie can be set is by a voluntary click from the user.” Leaving no doubt, Rakuten continues: “The offer may not automatically redirect to the advertiser website, even if the user has indicated that they ‘always’ want to receive rewards… It must be clicked on by the consumer before the offer can be redirected.”
- Awin Code of Conduct: “Publishers only initiate tracking via a tracking link used for click tracking if the user voluntarily and intentionally interacted with the Ad Media or Tracking link.” (emphasis added in each quote)
Kudos might argue that users should be allowed to authorize automatic clicks. But users cannot alter network rules because users are not the beneficiaries of those rules, and are not even privy to the contracts that establish those rules. In any event, a click on a minimize button or on whitespace is not an “affirmative click” and certainly not a “knowing” “voluntar[y] and intentional[] interact[ion] with the Ad Media or Tracking link.”
Chrome Web Store policies are on point too. Google requires “related user action … before the inclusion of each affiliate code, link, or cookie.” Google specifically criticizes invoking affiliate links “when no discount, cashback, or donation is provided.” Kudos violates this policy by invoking an affiliate link when a user merely clicks whitespace or a minimize/close button.
Towards resolution
Wildfire and Kudos should disable automatic clicks, and explain how this feature shipped. Who designed it? Who approved the feature generally? Who approved the decision to turn on Auto-activate Boost by default, and to turn that off in July 2026? Did anyone tell the networks about any of this?
Networks should audit Kudos and Wildfire traffic since July 29, 2025, when the feature appeared.
Merchants should demand refunds for commissions paid on auto-activated clicks, along with the fees passed through to their networks. If it’s not possible to determine which commissions came from automatic clicks, networks should make a reasonable estimate, erring on the side of returning more to merchants.
Wildfire and Kudos should also pay the costs merchants and networks incur to investigate and remediate.
My bottom line: Merchants paid commissions on sales Kudos claimed credit for, through clicks plainly outside governing contracts. Merchants and networks are entitled to learn how much money Kudos took from them, and to get it back.
Revisions to this article
I revised this article on October 26, 2026 to discuss my discovery of Kudos’ behavior from version 4.211.5 through 4.307.3, the period in which there was no user interface to disable Kudos’ automatic clicks. I also reorganized the introduction and timeline sections to discuss the new findings, and I updated the start date in the Resolution section.
I chose to expand and rework this article, rather than publish new findings in a new article, so that this document provides all relevant information in a single page, which I judge to be most useful for future readers.