Is BloxFinder - Join Anyone on Roblox safe?

Medium risk

BloxFinder is medium risk. On Roblox catalog pages, BloxFinder injects "Re-Upload" and "Save Template" buttons into item cards. Clicking either opens roexport.io/redirect, an undisclosed affiliate domain, confirmed routing to a Store page tagged utm_campaign.

BloxFinderv24Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

BloxFinder Injects Affiliate Redirect Buttons on Roblox Catalog Pages

On Roblox catalog pages, BloxFinder injects "Re-Upload" and "Save Template" buttons into item cards.

Clicking either opens roexport.io/redirect, an undisclosed affiliate domain, confirmed routing to a Store page tagged utm_campaign.

01EvidenceDOM DIFF
Page DOM modified

Target:

Before
<div class="item-card-container">
  <a class="item-card-link" href="/catalog/123456">
    <div class="item-card-thumb-container">...</div>
    <div class="item-card-caption">Roblox Shirt Name</div>
  </a>
</div>
After (modified by extension)
<div class="item-card-container">
  <a class="item-card-link" href="/catalog/123456">
    <div class="item-card-thumb-container">
      <div class="__xroe__" style="position:absolute;bottom:6px;left:6px;display:flex;gap:4px;z-index:100">
        <button class="__xroe_ib__ __xroe_e__"><!-- Save Template SVG --></button>
        <button class="__xroe_ib__ __xroe_r__"><!-- Re-Upload SVG --></button>
      </div>
      ...
    </div>
    <div class="__xroe__" style="display:flex;flex-direction:column;gap:6px;width:100%">
      <button style="background-color:#2d8a4e">Re-Upload</button>
      <button style="background-color:#393b3d">Save Template</button>
    </div>
    <div class="item-card-caption">Roblox Shirt Name</div>
  </a>
</div>
02EvidenceCODE COMPARE
Unknown block kind: code_compare

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "code_compare",
  "language": "js",
  "shipped": [],
  "deobfuscated": []
}
03EvidenceTHIRD PARTY LIST
Third-party destinations
  • roexport.io

    Affiliate redirect landing page; routes browser to the Chrome Web Store with utm_campaign=roexport.io tracking parameter

What it can do

Permissions this extension asks for, as declared in version 26.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 24, which we have not unpacked yet.

  • Read and change your data on roblox.com

    *://*.roblox.com/*

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

Updated 21 September 2026bnpkdbbfehooennlcojneoimfjgekdgn