Is ESUIT | AD Blocker for Facebook™ safe?

High risk

ESUIT | AD Blocker for Facebook™ is high risk. ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.…

ESUITv2.9.3Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Facebook page scripts get access to live page data

ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open Facebook while the extension is installed.

The extension did this

The extension runs scripts inside the Facebook page and gives them access to page modules, feed records, and request parameters.

02EvidenceFIELD TABLE
Facebook page data the code reads or rewrites
FieldValueWhy it matters
Feed unit record ID
feedUnit.__idLets the page script look up the record behind a feed item you are viewing.
Follow or join status
CAN_SUBSCRIBEShows whether Facebook says you can follow a person or join a group shown in your feed.
Sponsored content marker
sponsored_data.ad_idIdentifies feed items that Facebook marks as sponsored content in your page data.
Story text and placement
homepage_streamShows story title text and where Facebook placed that story in your feed.
GraphQL request name
fb_api_req_friendly_nameLets the page script select a Facebook request by its friendly operation name before it is serialized.
03EvidenceCODE COMPARE
The code that does this

Shipped code registers page-context Facebook scripts and exposes the hooks they use

What it actually does
Readable registration of the same page-context scriptsassets/index.ts-BQ14qvdn.js
chrome.scripting.registerContentScripts([{
  id: `inject-${T}`,
  js: ["injects/proxy.js"],
  matches: v,
  runAt: "document_start",
  world: "MAIN"
}]);
chrome.scripting.registerContentScripts([{
  id: `inject-${T}-module`,
  js: ["injects/vendors.js", "injects/index.js"],
  matches: v,
  runAt: "document_end",
  world: "MAIN"
}]);
Readable module-loader wrapperinjects/proxy.js
let i = window.__d;
window.__d && (~i.toString().indexOf("__d_stub") ? delete window.__d : i = new Proxy(window.__d, {
  apply: (t, n, o) => (o = r(o), t.apply(n, o))
})), Object.defineProperty(window, "__d", {
  get: function() {
    return i
  },
  set: function(t) {
    i = new Proxy(t, {
      apply: (n, o, f) => (f = r(f), n.apply(o, f))
    })
  }
});
Readable Relay store readerinjects/proxy.js
e.vTUNhjwVvX = !0, e.storeFinder = window.zKjqYvcSmF = (s, a, l) => {
  const y = e.RlbiULLGWt,
    u = typeof s == "string" ? y.get(s) : s;
  if (u === void 0) return u;
  let i = (d = a.replace(/\[(\d+)\]/g, ".$1"), d.replace(/\((.*?)\.(.*?)\)/g, "($1_*_*_*_*_$2)")).split(".");
  var d;
  i = i.map(t => (function(n) {
    return n.replaceAll("_*_*_*_*_", ".")
  })(t));
  let r = u;
  for (let t = 0; t < i.length; t++) {
    const n = i[t];
    if (n === "*") return r;
    if (n.indexOf("^^") === 0) {
      const [o, f] = c(n.substring(2));
      if (r = r.getLinkedRecords(o, f), r === void 0) return m(n), r
    } else if (n.indexOf("^") === 0) {
      const [o, f] = c(n.substring(1));
      if (r = r.getLinkedRecord(o, f), r == null) return m(n), r
    } else if (n.match(/^\d+$/)) {
      if (r = r[parseInt(n)], r == null) return m(n), r
    } else {
      const [o, f] = c(n);
      if (r = r.getValue(o, f), r == null) return m(n), r
    }
  }
  return r;

  function c(t) {
    const [n, o] = t.split("{");
    if (!o) return [n, {}];
    if (!l) throw new Error("args undefined");
    return [n, l[o.substring(0, o.length - 1)] || {}]
  }

  function m(t) {
    ~e.location.search.indexOf("debug") && console.warn("undefined value", {
      id: s,
      path: a,
      args: l,
      currentPath: t
    })
  }
}
Readable XHR serializer hookinjects/proxy.js
e.moduleProxyImmediately("xhrSimpleDataSerializer", a => {
  const l = a[4].exports.default;
  a[4].exports.default = function(...y) {
    const u = y[0].fb_api_req_friendly_name;
    return u && s[u] && (y[0] = s[u].reduce((i, d) => i = d(i), y[0])), l.apply(l, y)
  }
}), e.ajaxHijack = window.zkjQYvcSmF = (a, l) => {
  a = R(a), s[a] = s[a] || [], s[a].push(l)
}
Readable feed component replacementinjects/index.js
function B(e) {
  const t = h.get(e.payload, "feedUnit.id") || h.get(e.payload, "feedUnit.__id"),
    i = h.get(e.payload, "unitTypename", "none");
  if (!(window.location.pathname === "/")) return e.lastCmp;
  const _ = (t ? window.storeFinder(t, "^^actors[0].subscribe_status") : !1) === "CAN_SUBSCRIBE",
    u = (t ? window.storeFinder(t, "^to.viewer_forum_join_state") : !1) === "CAN_JOIN",
    p = t ? !!window.storeFinder(t, "^sponsored_data.ad_id") : !1;
  if (window.remove_reels_for_facebook[n.GROUP_YOU_MIGHT_LIKE].enable && N.includes(i)) return o.jsx(l, {
    OriginalContent: e.lastCmp,
    type: r.GROUP_YOU_MIGHT_LIKE
  });
  if (window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsx(l, {
    OriginalContent: e.lastCmp,
    type: r.SUGGESTED
  });
  if (!window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsxs("div", {
    className: "CometFeedUnit",
    children: [o.jsx(H, {}), o.jsx(o.Fragment, {
      children: e.lastCmp
    })]
  });
  if (window.remove_reels_for_facebook[n.SPONSORED].enable && p) return o.jsx(l, {
    OriginalContent: e.lastCmp,
    type: r.SPONSORED
  });
  const w = h.get(e.payload, "feedUnit.__id", !1) ? h.get(e.payload, "feedUnit.__id", !1) : h.get(e.payload, "children[0].props.children.props.feedUnit.__id", !1);
  if (w) {
    if (window.storeFinder(w, "showcase_story_type") === "SHOWCASE_SHORT_VIDEO" && window.remove_reels_for_facebook[n.REELS].enable) return o.jsx(l, {
      OriginalContent: e.lastCmp,
      type: r.REELS
    });
    if (window.storeFinder(w, "^story_header{$1}.^title.text", {
        $1: {
          location: "homepage_stream"
        }
      }) && window.remove_reels_for_facebook[n.SUGGESTED].enable) return o.jsx(l, {
      OriginalContent: e.lastCmp,
      type: r.SUGGESTED
    })
  }
  return w && window.storeFinder(w, "^story_header{$1}.^title.text", {
    $1: {
      location: "groups_tab"
    }
  }) && window.remove_reels_for_facebook[n.SUGGESTED].enable ? o.jsx(l, {
    OriginalContent: e.lastCmp,
    type: r.SUGGESTED
  }) : o.jsx("div", {
    className: "CometFeedUnit",
    children: o.jsx(o.Fragment, {
      children: e.lastCmp
    })
  })
}
04EvidenceDOM DIFF
Page DOM modified

Target: Facebook feed React component output

When the configured option is enabled, the replacement component can return extension-generated output instead of Facebook's original feed component.

Before
return e.lastCmp
After (modified by extension)
return o.jsx(l, {
  OriginalContent: e.lastCmp,
  type: r.SPONSORED
})
Updated 17 September 2026jkbklfkombochacjoeagggbiohipcbaj