Is RoRegion safe?

Question

Is RoRegion safe?

Accepted Answer

RoRegion is medium risk. When you visit a Roblox catalog or bundle page, RoRegion automatically suppresses the native Roblox purchase buttons via injected CSS and inserts a 'Buy with RoEarn' button in their place. Clicking that button opens the RoEarn cashback extension's Chrome Web Store listing. This modification runs on every roblox.com page load and is not disclosed in RoRegion's extension description, which advertises only lag reduction and server selection. RoRegion's background service worker listens for a message type called 'injectScript' from any of its content scripts. When that message arrives, the background script takes whatever JavaScript string was sent, creates a script element containing it, and runs it directly inside the Roblox page's JavaScript environment — with full access to Roblox's own API objects, DOM, and any credentials or tokens present on the page. The extension's own content scripts send this message to enable game-launch functionality, but the same channel accepts any string without validation.

Is RoRegion – Reduce Lag, Ping & Boost FPS: Roblox Region Selector safe?

Findings