Is SearchBlox - Join Anyone on RobIox safe?

Medium risk

SearchBlox is medium risk. Content scripts on Roblox pages check sign-in status and overlay RoEarn buttons on catalog, bundle, and game-pass areas. Clicking one opens RoEarn's Web Store listing with a campaign parameter, unrelated to the search feature.

SearchBloxv19Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SearchBlox replaces Roblox purchase buttons with RoEarn links

Content scripts on Roblox pages check sign-in status and overlay RoEarn buttons on catalog, bundle, and game-pass areas.

Clicking one opens RoEarn's Web Store listing with a campaign parameter, unrelated to the search feature.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You browse a Roblox catalog, bundle, or game store page while signed in.

The extension's manifest loads catalogScript.js and passScript.js on roblox.com pages.

The extension did this

SearchBlox changes the purchase area and adds a RoEarn promotion button.

Catalog pages receive .purchase-reward-button; game-pass store cards receive .gamepass-reward-action.

Page inputs used before the purchase area is changed
  • Roblox page URL
    https://www.roblox.com/catalog/123456789/example-item (illustrative)

    Identifies which Roblox item, bundle, or game page you are viewing so the script can decide whether to run.

  • Signed-in Roblox user
    123456789

    Confirms that your Roblox session is active before the purchase-area change proceeds.

  • Catalog or bundle item ID
    123456789

    Connects the page you are viewing to Roblox catalog details used for eligibility and reward calculations.

  • Purchase button state
    .btn-container[data-integration="active"]

    Lets the script locate the Roblox purchase control and place its own RoEarn button before it.

  • Game-pass expected price
    data-expected-price="100"

    Determines whether a game-pass purchase button receives a RoEarn reward-style replacement.

Captured request
GEThttps://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=catalog

Catalog-page button click opens the RoEarn Chrome Web Store listing; no request body is part of this navigation.

Captured request
GEThttps://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=gamepass

Game-pass button click opens the same RoEarn listing with the gamepass campaign parameter; no request body is part of this navigation.

The code that does this

Content scripts that hide Roblox purchase controls and open RoEarn

Readable version

Readable shipped catalog CSS injection function

catalogScript.js
function setupStyles() {  const styleElement = document.createElement('style');  styleElement.textContent = `      @keyframes color-pulse {        0% {          background-position: 0% 50%;        }        50% {          background-position: 100% 50%;        }        100% {          background-position: 0% 50%;        }      }            .shopping-cart-buy-button.item-purchase-btns-container .btn-container {        display: none !important;      }            .shopping-cart-buy-button.item-purchase-btns-container .btn-container[data-ineligible="yes"] {        display: block !important;      }            .purchase-reward-button {        width: 100%;        height: 52px;        border: none;        color: white;        text-shadow: 0 1px 2px rgba(0, 0, 0, 0.5), 0 0 8px rgba(0, 0, 0, 0.3);        font-weight: bold;        display: flex;        align-items: center;        justify-content: center;        font-size: 20px;        cursor: pointer;        background: linear-gradient(90deg,           #6bb5ff,           #a66bff,           #d66bff,           #ff6bbd,          #d66bff,          #a66bff,          #6bb5ff        );        background-size: 200% 100%;        animation: color-pulse 6s ease-in-out infinite;        border-radius: 4px;      }            .purchase-reward-wrapper {        margin-bottom: 10px;      }    `;  document.head.appendChild(styleElement);}

Readable shipped catalog promotion click handler

catalogScript.js
function constructRewardButton(rewardValue) {  const containerDiv = document.createElement('div');  containerDiv.className = 'purchase-reward-wrapper';    const buttonElement = document.createElement('button');  buttonElement.className = 'purchase-reward-button';  buttonElement.type = 'button';    const originalIcon = document.querySelector('.icon-robux-16x16');  const iconCopy = originalIcon ? originalIcon.cloneNode(true) : document.createElement('span');    if (originalIcon) {    iconCopy.style.display = 'inline-block';    iconCopy.style.marginLeft = '2px';    iconCopy.style.marginRight = '0px';    iconCopy.style.filter = 'brightness(0) invert(1) drop-shadow(0 1px 2px rgba(0, 0, 0, 0.5)) drop-shadow(0 0 8px rgba(0, 0, 0, 0.3))';  }    const formattedReward = formatCurrency(rewardValue);    buttonElement.textContent = 'Buy with RoEarn (Earn ';  buttonElement.appendChild(iconCopy);  buttonElement.appendChild(document.createTextNode(' ' + formattedReward + ')'));    buttonElement.addEventListener('click', function(event) {    event.preventDefault();    event.stopPropagation();    window.open('https://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=catalog', '_blank');  });    containerDiv.appendChild(buttonElement);  return { container: containerDiv, button: buttonElement };}

Readable shipped game-pass CSS injection function

passScript.js
function injectStylesheet() {  if (document.getElementById('gamepass-reward-styles')) return;    const styleSheet = document.createElement('style');  styleSheet.id = 'gamepass-reward-styles';  styleSheet.textContent = `      @keyframes gradient-wave {        0% {          background-position: 0% 50%;        }        50% {          background-position: 100% 50%;        }        100% {          background-position: 0% 50%;        }      }            .PurchaseButton.rbx-gear-passes-purchase {        display: none !important;      }            .PurchaseButton.rbx-gear-passes-purchase[data-ineligible="yes"] {        display: block !important;      }            .gamepass-reward-action {        background: linear-gradient(90deg,           #6bb5ff,           #a66bff,           #d66bff,           #ff6bbd,          #d66bff,          #a66bff,          #6bb5ff        );        background-size: 200% 100%;        animation: gradient-wave 6s ease-in-out infinite;        height: 50px;        border: none;        border-radius: 8px;        color: white;        text-shadow: 0 1px 2px rgba(0, 0, 0, 0.5), 0 0 8px rgba(0, 0, 0, 0.3);        font-weight: bold;        display: flex;        align-items: center;        justify-content: center;        font-size: 14px;        margin-bottom: 12px;        cursor: pointer;        flex-direction: column;        gap: 2px;      }    `;  document.head.appendChild(styleSheet);}

Readable shipped game-pass promotion click handler

passScript.js
function constructActionButton(earnAmount) {  const actionButton = document.createElement('button');  actionButton.className = 'btn-buy-md btn-full-width gamepass-reward-action';  actionButton.type = 'button';    const labelTop = document.createElement('div');  labelTop.textContent = 'Buy';  labelTop.style.width = '100%';  labelTop.style.textAlign = 'center';  labelTop.style.fontSize = '16.8px';  labelTop.style.fontWeight = 'bold';  labelTop.style.color = 'white';    const labelBottom = document.createElement('div');  labelBottom.style.display = 'flex';  labelBottom.style.alignItems = 'center';  labelBottom.style.justifyContent = 'center';  labelBottom.style.width = '100%';  labelBottom.style.fontSize = '14px';  labelBottom.style.color = 'white';    const robuxIcon = createRobuxIcon();    labelBottom.appendChild(document.createTextNode('(Earn '));  labelBottom.appendChild(robuxIcon);  labelBottom.appendChild(document.createTextNode(' ' + earnAmount + ')'));    actionButton.appendChild(labelTop);  actionButton.appendChild(labelBottom);    actionButton.addEventListener('click', function(clickEvent) {    clickEvent.preventDefault();    clickEvent.stopPropagation();    window.open('https://chromewebstore.google.com/detail/roearn-cashback-on-roblox/fooenmopnfaejehogdbmegaleanpdcea?utm_campaign=gamepass', '_blank');  });    return actionButton;}

Readable shipped game-pass DOM insertion function

passScript.js
function enhancePurchaseButton(buttonElement) {  const footerContainer = buttonElement.closest('.store-card-footer');  if (footerContainer.querySelector('.gamepass-reward-action')) return;    const cardContainer = buttonElement.closest('.store-card');  const captionContainer = buttonElement.closest('.store-card-caption');  const listItemContainer = buttonElement.closest('.list-item');    if (cardContainer) {    cardContainer.style.overflow = 'visible';    cardContainer.style.height = 'auto';    cardContainer.style.minHeight = 'auto';  }  if (captionContainer) {    captionContainer.style.overflow = 'visible';    captionContainer.style.height = 'auto';    captionContainer.style.minHeight = 'auto';  }  if (listItemContainer) {    listItemContainer.style.overflow = 'visible';    listItemContainer.style.height = 'auto';  }  if (footerContainer) {    footerContainer.style.overflow = 'visible';    footerContainer.style.height = 'auto';  }    const expectedPrice = parseInt(buttonElement.getAttribute('data-expected-price')) || 0;  const calculatedEarnings = computeRewardAmount(expectedPrice);    const passesRequirements = meetsEligibilityRequirements(expectedPrice, calculatedEarnings);    if (!passesRequirements) {    buttonElement.setAttribute('data-ineligible', 'yes');    return;  }    const rewardButton = constructActionButton(calculatedEarnings);  footerContainer.insertBefore(rewardButton, buttonElement);}
External hosts involved in the purchase-area flow
    • users.roblox.com

    Roblox authenticated-user endpoint called with session cookies before the page modification proceeds.

    • catalog.roblox.com

    Roblox catalog details endpoint used to fetch item or bundle data for reward and eligibility calculations.

    • chromewebstore.google.com

    Destination opened when the inserted RoEarn catalog or game-pass promotion button is clicked.

Updated 21 September 2026ccdcekhamjgodmpfeahkdmjaacjimaik