Is BuxBack - Earn R$ safe?
BuxBack - Earn R$ has no confirmed reviewed findings in the scanner yet.
The current database has no confirmed claims for this extension, so this summary does not describe any reviewed data transmission or request-modification behavior. A draft claim mentions Roblox purchase-request changes, but it has no verification result or evidence rows and is not included as confirmed behavior.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Roblox purchases are replayed with a BuxBack referral id
When you make a Roblox purchase, BuxBack can block the request and replay it to Roblox's economy endpoint with a referral id, using page DOM details and headers (incl.
CSRF token) against economy.roblox.com/v1/purchases/products/{id}?1.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You attempt a Roblox purchase while the extension's remote referral configuration is active.
The extension blocks the normal purchase XHR and replays it with a remotely configured BuxBack referral id.
- Roblox purchase page detailsdata-product-id=123456789 (illustrative)
Identifies the product, expected price, and expected seller from the purchase button on the page.
- Roblox request headersX-CSRF-TOKEN: abc123... (illustrative)
Carries the CSRF token and session-backed request context used to submit the purchase request.
What it can do
Permissions this extension asks for, as declared in version 2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on roblox.com
https://*.roblox.com/*
Read and change your data on rbxcdn.com
https://*.rbxcdn.com/*
Read and change your data on blox.land
https://*.blox.land/*
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest
Show you desktop notifications
notifications