Is ESUIT | AD Blocker for Facebook™ safe?
ESUIT | AD Blocker for Facebook™ is high risk. ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Facebook page scripts get access to live page data
ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.
What actually happens
You open Facebook while the extension is installed.
The extension runs scripts inside the Facebook page and gives them access to page modules, feed records, and request parameters.
Facebook page data the code reads or rewrites
- Feed unit record IDfeedUnit.__id
Lets the page script look up the record behind a feed item you are viewing.
- Follow or join statusCAN_SUBSCRIBE
Shows whether Facebook says you can follow a person or join a group shown in your feed.
- Sponsored content markersponsored_data.ad_id
Identifies feed items that Facebook marks as sponsored content in your page data.
- Story text and placementhomepage_stream
Shows story title text and where Facebook placed that story in your feed.
- GraphQL request namefb_api_req_friendly_name
Lets the page script select a Facebook request by its friendly operation name before it is serialized.
The code that does this
Shipped code registers page-context Facebook scripts and exposes the hooks they use
Readable registration of the same page-context scripts
assets/index.ts-BQ14qvdn.jschrome.scripting.registerContentScripts([{ id: `inject-${T}`, js: ["injects/proxy.js"], matches: v, runAt: "document_start", world: "MAIN"}]);chrome.scripting.registerContentScripts([{ id: `inject-${T}-module`, js: ["injects/vendors.js", "injects/index.js"], matches: v, runAt: "document_end", world: "MAIN"}]);Readable module-loader wrapper
injects/proxy.jslet i = window.__d;window.__d && (~i.toString().indexOf("__d_stub") ? delete window.__d : i = new Proxy(window.__d, { apply: (t, n, o) => (o = r(o), t.apply(n, o))})), Object.defineProperty(window, "__d", { get: function() { return i }, set: function(t) { i = new Proxy(t, { apply: (n, o, f) => (f = r(f), n.apply(o, f)) }) }});Readable Relay store reader
injects/proxy.jse.vTUNhjwVvX = !0, e.storeFinder = window.zKjqYvcSmF = (s, a, l) => { const y = e.RlbiULLGWt, u = typeof s == "string" ? y.get(s) : s; if (u === void 0) return u; let i = (d = a.replace(/\[(\d+)\]/g, ".$1"), d.replace(/\((.*?)\.(.*?)\)/g, "($1_*_*_*_*_$2)")).split("."); var d; i = i.map(t => (function(n) { return n.replaceAll("_*_*_*_*_", ".") })(t)); let r = u; for (let t = 0; t < i.length; t++) { const n = i[t]; if (n === "*") return r; if (n.indexOf("^^") === 0) { const [o, f] = c(n.substring(2)); if (r = r.getLinkedRecords(o, f), r === void 0) return m(n), r } else if (n.indexOf("^") === 0) { const [o, f] = c(n.substring(1)); if (r = r.getLinkedRecord(o, f), r == null) return m(n), r } else if (n.match(/^\d+$/)) { if (r = r[parseInt(n)], r == null) return m(n), r } else { const [o, f] = c(n); if (r = r.getValue(o, f), r == null) return m(n), r } } return r; function c(t) { const [n, o] = t.split("{"); if (!o) return [n, {}]; if (!l) throw new Error("args undefined"); return [n, l[o.substring(0, o.length - 1)] || {}] } function m(t) { ~e.location.search.indexOf("debug") && console.warn("undefined value", { id: s, path: a, args: l, currentPath: t }) }}Readable XHR serializer hook
injects/proxy.jse.moduleProxyImmediately("xhrSimpleDataSerializer", a => { const l = a[4].exports.default; a[4].exports.default = function(...y) { const u = y[0].fb_api_req_friendly_name; return u && s[u] && (y[0] = s[u].reduce((i, d) => i = d(i), y[0])), l.apply(l, y) }}), e.ajaxHijack = window.zkjQYvcSmF = (a, l) => { a = R(a), s[a] = s[a] || [], s[a].push(l)}Readable feed component replacement
injects/index.jsfunction B(e) { const t = h.get(e.payload, "feedUnit.id") || h.get(e.payload, "feedUnit.__id"), i = h.get(e.payload, "unitTypename", "none"); if (!(window.location.pathname === "/")) return e.lastCmp; const _ = (t ? window.storeFinder(t, "^^actors[0].subscribe_status") : !1) === "CAN_SUBSCRIBE", u = (t ? window.storeFinder(t, "^to.viewer_forum_join_state") : !1) === "CAN_JOIN", p = t ? !!window.storeFinder(t, "^sponsored_data.ad_id") : !1; if (window.remove_reels_for_facebook[n.GROUP_YOU_MIGHT_LIKE].enable && N.includes(i)) return o.jsx(l, { OriginalContent: e.lastCmp, type: r.GROUP_YOU_MIGHT_LIKE }); if (window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsx(l, { OriginalContent: e.lastCmp, type: r.SUGGESTED }); if (!window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsxs("div", { className: "CometFeedUnit", children: [o.jsx(H, {}), o.jsx(o.Fragment, { children: e.lastCmp })] }); if (window.remove_reels_for_facebook[n.SPONSORED].enable && p) return o.jsx(l, { OriginalContent: e.lastCmp, type: r.SPONSORED }); const w = h.get(e.payload, "feedUnit.__id", !1) ? h.get(e.payload, "feedUnit.__id", !1) : h.get(e.payload, "children[0].props.children.props.feedUnit.__id", !1); if (w) { if (window.storeFinder(w, "showcase_story_type") === "SHOWCASE_SHORT_VIDEO" && window.remove_reels_for_facebook[n.REELS].enable) return o.jsx(l, { OriginalContent: e.lastCmp, type: r.REELS }); if (window.storeFinder(w, "^story_header{$1}.^title.text", { $1: { location: "homepage_stream" } }) && window.remove_reels_for_facebook[n.SUGGESTED].enable) return o.jsx(l, { OriginalContent: e.lastCmp, type: r.SUGGESTED }) } return w && window.storeFinder(w, "^story_header{$1}.^title.text", { $1: { location: "groups_tab" } }) && window.remove_reels_for_facebook[n.SUGGESTED].enable ? o.jsx(l, { OriginalContent: e.lastCmp, type: r.SUGGESTED }) : o.jsx("div", { className: "CometFeedUnit", children: o.jsx(o.Fragment, { children: e.lastCmp }) })}Page DOM modified
When the configured option is enabled, the replacement component can return extension-generated output instead of Facebook's original feed component.
- Target
- Facebook feed React component output
return e.lastCmpreturn o.jsx(l, { OriginalContent: e.lastCmp, type: r.SPONSORED})