Is Roblox Friend Remover Button safe?

Medium risk

Roblox Friend Remover Button modifies Roblox purchase pages to promote RoEarn and roexport redirects.

On Roblox catalog and game-pass pages, its content scripts hide eligible purchase controls and add RoEarn promotional buttons that open the RoEarn Chrome Web Store page. It also adds Save Template and Re-Upload controls for clothing items that open roexport.io/redirect.

Samzyv20.5Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Roblox purchase areas are replaced with promo redirects

This runs content scripts on Roblox pages, changes catalog/store purchase areas, and adds RoEarn or roexport controls.

RoEarn buttons open a Web Store listing with campaign params; Save Template/Re-Upload open roexport.io/redirect.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a Roblox catalog item, bundle, clothing card, or game store page.

The extension manifest matches every roblox.com page, so the content scripts run during normal Roblox browsing.

The extension did this

The extension changes the purchase area and adds buttons that point away from Roblox.

Catalog and game-pass pages receive RoEarn buttons; clothing catalog cards and item pages receive Save Template and Re-Upload controls.

Concrete page elements and destinations changed by the scripts
  • Roblox page scope
    *://*.roblox.com/*

    This behavior follows you across matching Roblox catalog and game pages rather than one isolated screen.

  • Original catalog purchase area
    .shopping-cart-buy-button.item-purchase-btns-container .btn-container

    The normal Roblox buy control can be removed from view before the added RoEarn control is inserted.

  • Original game-pass purchase area
    .PurchaseButton.rbx-gear-passes-purchase

    The Roblox game-pass buy button area can be removed from view while an added RoEarn button is placed before it.

  • RoEarn catalog button
    https://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=catalog

    Clicking the added catalog button opens a Chrome Web Store listing instead of completing a Roblox purchase action directly.

  • Roexport clothing buttons
    https://roexport.io/redirect

    Clicking the added Save Template or Re-Upload controls opens a roexport redirect destination.

Captured request
GEThttps://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=catalog

Browser navigation opened by the injected RoEarn catalog button; GET navigation has no request body.

Captured request
GEThttps://roexport.io/redirect

Browser navigation opened by injected Save Template or Re-Upload controls; GET navigation has no request body.

The code that does this

Shipped content scripts that alter Roblox purchase flows

Readable version

Manifest applies the scripts to Roblox pages

manifest.json
"content_scripts": [  {    "js": [      "content.js",      "checkP.js",      "gamepassP.js",      "catalogP.js",      "locale.js"    ],    "matches": [      "*://*.roblox.com/*"    ]  },  {    "matches": [      "*://*.roblox.com/*"    ],    "js": [      "insertButtons.js"    ],    "run_at": "document_idle"  },  {    "js": [      "sidebar.js"    ],    "matches": [      "*://*.roblox.com/*"    ],    "run_at": "document_start"  }]

Catalog purchase area is removed from view and replaced with a RoEarn button

catalogP.js
cssRules.textContent = `  .shopping-cart-buy-button.item-purchase-btns-container .btn-container {    display: none !important;  }  .shopping-cart-buy-button.item-purchase-btns-container .btn-container[data-roearn-not-eligible="true"] {    display: block !important;  }  .roearn-promo-button {    width: 100%;    height: 52px;    border: none;    color: white;    font-weight: bold;    display: flex;    align-items: center;    justify-content: center;    cursor: pointer;  }`;buttonContainer.setAttribute('data-roearn-added', 'true');const wrapper = document.createElement('div');wrapper.className = 'roearn-promo-container';const actionButton = document.createElement('button');actionButton.className = 'roearn-promo-button';actionButton.type = 'button';actionButton.textContent = 'Buy with RoEarn (Earn ';actionButton.addEventListener('click', (evt) => {  evt.preventDefault();  evt.stopPropagation();  window.open('https://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=catalog', '_blank');});wrapper.appendChild(actionButton);buttonContainer.parentNode.insertBefore(wrapper, buttonContainer);

Game-pass purchase buttons get a RoEarn button before the Roblox button

gamepassP.js
animationCSS.textContent = `  .PurchaseButton.rbx-gear-passes-purchase {    display: none !important;  }  .PurchaseButton.rbx-gear-passes-purchase[data-roearn-not-eligible="true"] {    display: block !important;  }  .roearn-gamepass-promo-button {    height: 50px;    border: none;    border-radius: 8px;    color: white;    font-weight: bold;    display: flex;    align-items: center;    justify-content: center;    cursor: pointer;  }`;const allPurchaseBtns = document.querySelectorAll('#rbx-passes-container .PurchaseButton');allPurchaseBtns.forEach((buyButton) => {  const footerElement = buyButton.closest('.store-card-footer');  if (footerElement.querySelector('.roearn-gamepass-promo-button')) return;  const promoButton = document.createElement('button');  promoButton.className = 'btn-buy-md btn-full-width roearn-gamepass-promo-button';  promoButton.type = 'button';  promoButton.addEventListener('click', (clickEvent) => {    clickEvent.preventDefault();    clickEvent.stopPropagation();    window.open('https://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=gamepass', '_blank');  });  footerElement.insertBefore(promoButton, buyButton);});

Clothing catalog controls open roexport.io

insertButtons.js
const REDIRECT = 'https://roexport.io/redirect';const CLOTHING = /\/(Shirt|Pants|Tshirt)\//;const CLOTHING_TYPES = new Set([2, 11, 12]);function goRedirect(e) {  e.preventDefault();  e.stopPropagation();  window.open(REDIRECT, '_blank');}function injectCardButtons(card) {  if (card.querySelector('.' + CLS_WRAP)) return;  const img = card.querySelector('.thumbnail-2d-container img');  if (!img || !CLOTHING.test(img.src)) return;  const anchor = card.querySelector('a.item-card-link[href]');  if (!anchor || !anchor.href.match(/\/catalog\/(\d+)/)) return;  const uploadBtn = document.createElement('button');  uploadBtn.addEventListener('click', goRedirect);  const saveBtn = document.createElement('button');  saveBtn.addEventListener('click', goRedirect);}function injectCatalogSection() {  const match = window.location.pathname.match(/\/catalog\/(\d+)/);  if (!match) return;  fetch(`https://catalog.roblox.com/v1/catalog/items/${match[1]}/details?itemType=asset`, { credentials: 'include' })    .then(r => r.json())    .then(data => {      if (!data || !CLOTHING_TYPES.has(data.assetType)) return;      const uploadBtn = document.createElement('button');      uploadBtn.innerHTML = `${ICON_UPLOAD_LG}<span>${labelUpload}</span>`;      uploadBtn.addEventListener('click', goRedirect);      const saveBtn = document.createElement('button');      saveBtn.innerHTML = `${ICON_EXPORT_LG}<span>${labelSave}</span>`;      saveBtn.addEventListener('click', goRedirect);    })    .catch(() => {});}
Hosts contacted or opened by the Roblox content scripts
    • chromewebstore.google.com

    Receives the browser navigation opened by the RoEarn catalog, game-pass, and sidebar promotional controls.

    • roexport.io

    Receives the browser navigation opened by the Save Template and Re-Upload clothing controls.

    • users.roblox.com

    Roblox API endpoint used by the content scripts to check the current authenticated user before adding RoEarn purchase controls.

    • catalog.roblox.com

    Roblox API endpoint used by the scripts to look up catalog item details, prices, asset types, and clothing eligibility.

Where it sends data

Destinations our analysis observed Roblox Friend Remover Button contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chromewebstore.google.com

    Roblox Friend Remover Button sends data to chromewebstore.google.com. 2 other extensions we have analysed send data here.

  • roexport.io

    Roblox Friend Remover Button sends data to roexport.io. One other extension we have analysed sends data here.

Updated 21 September 2026akbdgjmoamonjafappffkkpeamccbcie