BTRoblox - Making Roblox BetterSecurity Analysis

Injects and executes scripts in web pages programmatically.

Creates functions from strings, similar to eval(), often used to hide malicious code.

Dynamically sets a script's src attribute to load external code at runtime.

Modifies window.location to redirect the user, potentially to phishing or malicious pages.

Makes HTTP requests to external servers, may be used for data exfiltration.

Decodes base64 data, commonly used to hide malicious payloads.

Fetches external URL: https://users.roblox.com/v1/users/authenticated

Line exceeds 5000 characters (entropy: 4.939050719905807)

This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.

Reads or writes to localStorage, which may contain sensitive site data.

Sets innerHTML directly, which can lead to XSS if used with untrusted data.

Encodes data to base64, may be used for data exfiltration.

String with entropy 5.64 bits — may be encoded/encrypted data