Is ESUIT | AD Blocker for Facebook™ safe?
ESUIT | AD Blocker for Facebook™ is high risk. ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Facebook page scripts get access to live page data
ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.
You open Facebook while the extension is installed.
The extension runs scripts inside the Facebook page and gives them access to page modules, feed records, and request parameters.
| Field | Value | Why it matters | |
|---|---|---|---|
Feed unit record ID | feedUnit.__id | Lets the page script look up the record behind a feed item you are viewing. | |
Follow or join status | CAN_SUBSCRIBE | Shows whether Facebook says you can follow a person or join a group shown in your feed. | |
Sponsored content marker | sponsored_data.ad_id | Identifies feed items that Facebook marks as sponsored content in your page data. | |
Story text and placement | homepage_stream | Shows story title text and where Facebook placed that story in your feed. | |
GraphQL request name | fb_api_req_friendly_name | Lets the page script select a Facebook request by its friendly operation name before it is serialized. |
Shipped code registers page-context Facebook scripts and exposes the hooks they use
chrome.scripting.registerContentScripts([{
id: `inject-${T}`,
js: ["injects/proxy.js"],
matches: v,
runAt: "document_start",
world: "MAIN"
}]);
chrome.scripting.registerContentScripts([{
id: `inject-${T}-module`,
js: ["injects/vendors.js", "injects/index.js"],
matches: v,
runAt: "document_end",
world: "MAIN"
}]);let i = window.__d;
window.__d && (~i.toString().indexOf("__d_stub") ? delete window.__d : i = new Proxy(window.__d, {
apply: (t, n, o) => (o = r(o), t.apply(n, o))
})), Object.defineProperty(window, "__d", {
get: function() {
return i
},
set: function(t) {
i = new Proxy(t, {
apply: (n, o, f) => (f = r(f), n.apply(o, f))
})
}
});e.vTUNhjwVvX = !0, e.storeFinder = window.zKjqYvcSmF = (s, a, l) => {
const y = e.RlbiULLGWt,
u = typeof s == "string" ? y.get(s) : s;
if (u === void 0) return u;
let i = (d = a.replace(/\[(\d+)\]/g, ".$1"), d.replace(/\((.*?)\.(.*?)\)/g, "($1_*_*_*_*_$2)")).split(".");
var d;
i = i.map(t => (function(n) {
return n.replaceAll("_*_*_*_*_", ".")
})(t));
let r = u;
for (let t = 0; t < i.length; t++) {
const n = i[t];
if (n === "*") return r;
if (n.indexOf("^^") === 0) {
const [o, f] = c(n.substring(2));
if (r = r.getLinkedRecords(o, f), r === void 0) return m(n), r
} else if (n.indexOf("^") === 0) {
const [o, f] = c(n.substring(1));
if (r = r.getLinkedRecord(o, f), r == null) return m(n), r
} else if (n.match(/^\d+$/)) {
if (r = r[parseInt(n)], r == null) return m(n), r
} else {
const [o, f] = c(n);
if (r = r.getValue(o, f), r == null) return m(n), r
}
}
return r;
function c(t) {
const [n, o] = t.split("{");
if (!o) return [n, {}];
if (!l) throw new Error("args undefined");
return [n, l[o.substring(0, o.length - 1)] || {}]
}
function m(t) {
~e.location.search.indexOf("debug") && console.warn("undefined value", {
id: s,
path: a,
args: l,
currentPath: t
})
}
}e.moduleProxyImmediately("xhrSimpleDataSerializer", a => {
const l = a[4].exports.default;
a[4].exports.default = function(...y) {
const u = y[0].fb_api_req_friendly_name;
return u && s[u] && (y[0] = s[u].reduce((i, d) => i = d(i), y[0])), l.apply(l, y)
}
}), e.ajaxHijack = window.zkjQYvcSmF = (a, l) => {
a = R(a), s[a] = s[a] || [], s[a].push(l)
}function B(e) {
const t = h.get(e.payload, "feedUnit.id") || h.get(e.payload, "feedUnit.__id"),
i = h.get(e.payload, "unitTypename", "none");
if (!(window.location.pathname === "/")) return e.lastCmp;
const _ = (t ? window.storeFinder(t, "^^actors[0].subscribe_status") : !1) === "CAN_SUBSCRIBE",
u = (t ? window.storeFinder(t, "^to.viewer_forum_join_state") : !1) === "CAN_JOIN",
p = t ? !!window.storeFinder(t, "^sponsored_data.ad_id") : !1;
if (window.remove_reels_for_facebook[n.GROUP_YOU_MIGHT_LIKE].enable && N.includes(i)) return o.jsx(l, {
OriginalContent: e.lastCmp,
type: r.GROUP_YOU_MIGHT_LIKE
});
if (window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsx(l, {
OriginalContent: e.lastCmp,
type: r.SUGGESTED
});
if (!window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsxs("div", {
className: "CometFeedUnit",
children: [o.jsx(H, {}), o.jsx(o.Fragment, {
children: e.lastCmp
})]
});
if (window.remove_reels_for_facebook[n.SPONSORED].enable && p) return o.jsx(l, {
OriginalContent: e.lastCmp,
type: r.SPONSORED
});
const w = h.get(e.payload, "feedUnit.__id", !1) ? h.get(e.payload, "feedUnit.__id", !1) : h.get(e.payload, "children[0].props.children.props.feedUnit.__id", !1);
if (w) {
if (window.storeFinder(w, "showcase_story_type") === "SHOWCASE_SHORT_VIDEO" && window.remove_reels_for_facebook[n.REELS].enable) return o.jsx(l, {
OriginalContent: e.lastCmp,
type: r.REELS
});
if (window.storeFinder(w, "^story_header{$1}.^title.text", {
$1: {
location: "homepage_stream"
}
}) && window.remove_reels_for_facebook[n.SUGGESTED].enable) return o.jsx(l, {
OriginalContent: e.lastCmp,
type: r.SUGGESTED
})
}
return w && window.storeFinder(w, "^story_header{$1}.^title.text", {
$1: {
location: "groups_tab"
}
}) && window.remove_reels_for_facebook[n.SUGGESTED].enable ? o.jsx(l, {
OriginalContent: e.lastCmp,
type: r.SUGGESTED
}) : o.jsx("div", {
className: "CometFeedUnit",
children: o.jsx(o.Fragment, {
children: e.lastCmp
})
})
}Target: Facebook feed React component output
When the configured option is enabled, the replacement component can return extension-generated output instead of Facebook's original feed component.
return e.lastCmp
return o.jsx(l, {
OriginalContent: e.lastCmp,
type: r.SPONSORED
})