Is AdsMeta — Facebook Ads Manager safe?

Medium risk

AdsMeta reads your Facebook ad-account access token from facebook.com and shares it with its own adsmeta.io dashboard.

To power its ad-manager features, AdsMeta extracts the long-lived Facebook Graph API (EAA) access token tied to your ad accounts. Its service worker fetches Facebook pages with your session cookies and scrapes the token from the page HTML, caching it for 12 hours, and hands it to the adsmeta.io web dashboard when that site asks for it. A content script also writes the token into the page's sessionStorage on facebook.com, where any script running on that page can read it. External access to the token is restricted to the vendor's own adsmeta.io origins.

adsmetav5.3.14Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI SANDBOX

Service worker fetches Facebook using your cookies to harvest an access token

We observed the background service worker send a credentialed request to Facebook using your browser's own session cookies, with no Facebook tab open, then read your access token from the response.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the AdsMeta dashboard at adsmeta.io more than 12 hours after your Facebook token was last refreshed.

No Facebook tab needs to be open in the browser.

The extension did this

The background service worker sends a credentialed GET request to Facebook's Ads Manager using your browser's session cookies.

It then parses the returned page for an access token and saves it to local storage.

02EvidenceFIELD TABLE
Data touched by the background token fetch
FieldValueWhy it matters
Facebook session cookies
datr=<redacted>; sb=<redacted>Your logged-in Facebook session cookies are attached to the request automatically by the browser.
Facebook page requested
https://adsmanager.facebook.com/adsmanager/manage/campaignsThe extension loads Facebook's own Ads Manager page in the background to read a token off it.
Extracted access token
EAAG1a2B3c4D5e6F7g8H9i0J (illustrative)An EAA-prefixed Facebook access token is parsed out of the page and can call the Facebook Graph API as you.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://adsmanager.facebook.com/adsmanager/manage/campaigns
302 redirect to Facebook's own login page, because the test session was not signed into Facebook. The same code path returns a fully rendered Ads Manager page carrying the access token when the browser does have an active Facebook session.
Headers
Accepttext/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Cookiedatr=<redacted>; sb=<redacted>
04EvidenceSTORAGE DUMP
What's stored on your device

The harvested token and Facebook's anti-CSRF token stay cached 12 hours, reused by later requests without another background fetch.

Locationchrome.storage.local keys fb_token, fb_token_time, fb_fbdt
Contents (JSON)
{
  "fb_fbdt": "AQL8exampleDtsgToken (illustrative)",
  "fb_token": "EAAG1a2B3c4D5e6F7g8H9i0J... (illustrative)",
  "fb_token_time": 1757315520000
}
05EvidenceTHIRD PARTY LIST
Facebook domains the service worker can fetch headlessly
  • adsmanager.facebook.com

    First fetch target for the headless token harvest, using your session cookies.

  • business.facebook.com

    Fallback fetch target if adsmanager.facebook.com does not yield a token.

  • www.facebook.com

    Second fallback fetch target for the same headless token harvest.

Data recipients

adsmeta.iograph.facebook.com
Updated 17 September 2026ookgnahfklmejhicejjbfjifppjbfnlk