Is ESUIT | AD Blocker for Facebook™ safe?

High risk

ESUIT | AD Blocker for Facebook™ is high risk. ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.…

ESUITv2.9.3Chrome Web Store
69Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Facebook page scripts get access to live page data

MediumunwantedCWE-200Dynamic sandbox

ESUIT injects scripts into Facebook pages, not just its isolated context: they wrap the module loader, expose a Relay store reader, hook the XHR serializer, and replace feed React modules, letting it read/change Facebook page data.

What actually happens

You did this

You open Facebook while the extension is installed.

The extension did this

The extension runs scripts inside the Facebook page and gives them access to page modules, feed records, and request parameters.

Facebook page data the code reads or rewrites

  • Feed unit record ID
    feedUnit.__id

    Lets the page script look up the record behind a feed item you are viewing.

  • Follow or join status
    CAN_SUBSCRIBE

    Shows whether Facebook says you can follow a person or join a group shown in your feed.

  • Sponsored content marker
    sponsored_data.ad_id

    Identifies feed items that Facebook marks as sponsored content in your page data.

  • Story text and placement
    homepage_stream

    Shows story title text and where Facebook placed that story in your feed.

  • GraphQL request name
    fb_api_req_friendly_name

    Lets the page script select a Facebook request by its friendly operation name before it is serialized.

The code that does this

Shipped code registers page-context Facebook scripts and exposes the hooks they use

Readable version

Readable registration of the same page-context scripts

assets/index.ts-BQ14qvdn.js
chrome.scripting.registerContentScripts([{  id: `inject-${T}`,  js: ["injects/proxy.js"],  matches: v,  runAt: "document_start",  world: "MAIN"}]);chrome.scripting.registerContentScripts([{  id: `inject-${T}-module`,  js: ["injects/vendors.js", "injects/index.js"],  matches: v,  runAt: "document_end",  world: "MAIN"}]);

Readable module-loader wrapper

injects/proxy.js
let i = window.__d;window.__d && (~i.toString().indexOf("__d_stub") ? delete window.__d : i = new Proxy(window.__d, {  apply: (t, n, o) => (o = r(o), t.apply(n, o))})), Object.defineProperty(window, "__d", {  get: function() {    return i  },  set: function(t) {    i = new Proxy(t, {      apply: (n, o, f) => (f = r(f), n.apply(o, f))    })  }});

Readable Relay store reader

injects/proxy.js
e.vTUNhjwVvX = !0, e.storeFinder = window.zKjqYvcSmF = (s, a, l) => {  const y = e.RlbiULLGWt,    u = typeof s == "string" ? y.get(s) : s;  if (u === void 0) return u;  let i = (d = a.replace(/\[(\d+)\]/g, ".$1"), d.replace(/\((.*?)\.(.*?)\)/g, "($1_*_*_*_*_$2)")).split(".");  var d;  i = i.map(t => (function(n) {    return n.replaceAll("_*_*_*_*_", ".")  })(t));  let r = u;  for (let t = 0; t < i.length; t++) {    const n = i[t];    if (n === "*") return r;    if (n.indexOf("^^") === 0) {      const [o, f] = c(n.substring(2));      if (r = r.getLinkedRecords(o, f), r === void 0) return m(n), r    } else if (n.indexOf("^") === 0) {      const [o, f] = c(n.substring(1));      if (r = r.getLinkedRecord(o, f), r == null) return m(n), r    } else if (n.match(/^\d+$/)) {      if (r = r[parseInt(n)], r == null) return m(n), r    } else {      const [o, f] = c(n);      if (r = r.getValue(o, f), r == null) return m(n), r    }  }  return r;  function c(t) {    const [n, o] = t.split("{");    if (!o) return [n, {}];    if (!l) throw new Error("args undefined");    return [n, l[o.substring(0, o.length - 1)] || {}]  }  function m(t) {    ~e.location.search.indexOf("debug") && console.warn("undefined value", {      id: s,      path: a,      args: l,      currentPath: t    })  }}

Readable XHR serializer hook

injects/proxy.js
e.moduleProxyImmediately("xhrSimpleDataSerializer", a => {  const l = a[4].exports.default;  a[4].exports.default = function(...y) {    const u = y[0].fb_api_req_friendly_name;    return u && s[u] && (y[0] = s[u].reduce((i, d) => i = d(i), y[0])), l.apply(l, y)  }}), e.ajaxHijack = window.zkjQYvcSmF = (a, l) => {  a = R(a), s[a] = s[a] || [], s[a].push(l)}

Readable feed component replacement

injects/index.js
function B(e) {  const t = h.get(e.payload, "feedUnit.id") || h.get(e.payload, "feedUnit.__id"),    i = h.get(e.payload, "unitTypename", "none");  if (!(window.location.pathname === "/")) return e.lastCmp;  const _ = (t ? window.storeFinder(t, "^^actors[0].subscribe_status") : !1) === "CAN_SUBSCRIBE",    u = (t ? window.storeFinder(t, "^to.viewer_forum_join_state") : !1) === "CAN_JOIN",    p = t ? !!window.storeFinder(t, "^sponsored_data.ad_id") : !1;  if (window.remove_reels_for_facebook[n.GROUP_YOU_MIGHT_LIKE].enable && N.includes(i)) return o.jsx(l, {    OriginalContent: e.lastCmp,    type: r.GROUP_YOU_MIGHT_LIKE  });  if (window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsx(l, {    OriginalContent: e.lastCmp,    type: r.SUGGESTED  });  if (!window.remove_reels_for_facebook[n.SUGGESTED].enable && (_ || u)) return o.jsxs("div", {    className: "CometFeedUnit",    children: [o.jsx(H, {}), o.jsx(o.Fragment, {      children: e.lastCmp    })]  });  if (window.remove_reels_for_facebook[n.SPONSORED].enable && p) return o.jsx(l, {    OriginalContent: e.lastCmp,    type: r.SPONSORED  });  const w = h.get(e.payload, "feedUnit.__id", !1) ? h.get(e.payload, "feedUnit.__id", !1) : h.get(e.payload, "children[0].props.children.props.feedUnit.__id", !1);  if (w) {    if (window.storeFinder(w, "showcase_story_type") === "SHOWCASE_SHORT_VIDEO" && window.remove_reels_for_facebook[n.REELS].enable) return o.jsx(l, {      OriginalContent: e.lastCmp,      type: r.REELS    });    if (window.storeFinder(w, "^story_header{$1}.^title.text", {        $1: {          location: "homepage_stream"        }      }) && window.remove_reels_for_facebook[n.SUGGESTED].enable) return o.jsx(l, {      OriginalContent: e.lastCmp,      type: r.SUGGESTED    })  }  return w && window.storeFinder(w, "^story_header{$1}.^title.text", {    $1: {      location: "groups_tab"    }  }) && window.remove_reels_for_facebook[n.SUGGESTED].enable ? o.jsx(l, {    OriginalContent: e.lastCmp,    type: r.SUGGESTED  }) : o.jsx("div", {    className: "CometFeedUnit",    children: o.jsx(o.Fragment, {      children: e.lastCmp    })  })}

Page DOM modified

When the configured option is enabled, the replacement component can return extension-generated output instead of Facebook's original feed component.

Target
Facebook feed React component output
Before
return e.lastCmp
After the extension changed it
return o.jsx(l, {  OriginalContent: e.lastCmp,  type: r.SPONSORED})
Updated 21 September 2026jkbklfkombochacjoeagggbiohipcbaj