Is RoGold - Level Up Roblox safe?
We analyzed RoGold - Level Up Roblox version 1.9.4's actual code and gave it a 76/100 trust score. RoGold appears purpose-aligned and limited to Roblox,…
Bottom line
RoGold appears purpose-aligned and limited to Roblox, but its page access, external service traffic, and page-controlled actions warrant caution.
What it can access
The extension can read and change Roblox pages, use clipboard writing, and contact Roblox and RoGold services. [Q2] [Q5] [Q6] This is reasonably related to a Roblox-enhancement tool, but the page scope and authenticated Roblox requests still create meaningful access risk. [Q4]
Security weaknesses
Roblox page code can trigger exposed game and request actions without separate confirmation for every action. [Q16] The package also contains unresolved text-to-code capability, although active remote execution was not established. [Q7]
Signs of misuse
The review found feature-related sharing with Roblox and RoGold services, but no established collection of general browsing history, passwords, cookies, or clipboard contents. [Q6] [Q12] [Q14] Promotional RoGold links are present, without clear referral or advertisement abuse. [Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, menus, notifications, clipboard writing, and access to Roblox-related pages; this fits a Roblox-enhancement tool, but it still allows broad reading and modification within Roblox pages.
The extension requests storage, contextMenus, clipboardWrite, and notifications, and can access *.roblox.com and *.rbxcdn.com; its page code runs on www.roblox.com and web.roblox.com. — manifest.json:1
The reviewed runtime makes Roblox and RoGold-related service requests for feature data, status, rankings, prices, and related functions. — assets/inject.js-ryo_DxjW.js:3-4,32,349,532,2025,2265
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.roblox.com/*, *://*.rbxcdn.com/* — manifest.json:1
Content scripts run directly on: *://www.roblox.com/*, *://web.roblox.com/*, *://www.roblox.com/*, *://web.roblox.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension can read Roblox page elements and some message text for its features, but the reviewed runtime does not establish collection or transmission of passwords, payment details, or arbitrary form entries. Its content scripts are limited to Roblox pages, not general websites.
Content scripts run on www.roblox.com and web.roblox.com only. — manifest.json:25-48
A textarea is read in the context of a Roblox group-wall reply feature. — assets/inject.js-ryo_DxjW.js:820-821
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension lacks permissions for browser cookies, history, bookmarks, and downloads. It can make normal authenticated requests to Roblox while a Roblox page is open, but that does not grant access to arbitrary browser data or let the extension read cookies.
Only storage, contextMenus, clipboardWrite, and notifications permissions are declared, with Roblox and rbxcdn host permissions. — manifest.json:49-58
Roblox-page requests use credentials include. — assets/inject.js-ryo_DxjW.js:3-4
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests access outside ordinary web pages: clipboardWrite.
The manifest requests: clipboardWrite — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends requests to Roblox and several RoGold-related services for Roblox features, status, rankings, prices, and related data. Authenticated requests to Roblox may carry the user’s normal Roblox credentials, while the reviewed code does not establish transmission of passwords or general browsing history.
Roblox requests use credentials include. — assets/inject.js-ryo_DxjW.js:3-4
The bundle contains requests to Roblox and external RoGold-related endpoints for feature data and status. — assets/inject.js-ryo_DxjW.js:32,349,532,2025,2265
Does it download or run code, settings, or instructions supplied by a remote server?
The bundle contains code capable of evaluating fetched script text through bundled jQuery, but the available evidence does not prove that a remote server supplies executable extension instructions or that this path is reached. The large generated bundle leaves that runtime question unresolved.
The principal runtime is a large minified/generated bundle containing bundled library code. — assets/inject.js-ryo_DxjW.js:1-2418
Bundled jQuery includes globalEval and _evalUrl-related machinery. — assets/inject.js-ryo_DxjW.js:7
Remote status/data requests are visible, but the cited path does not establish execution of their responses. — assets/inject.js-ryo_DxjW.js:2265
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension automatically runs on Roblox pages, changes their interface, and makes feature requests without a separate click for every operation. Some consequential actions, such as posting a reply or joining a game, depend on page state or user interaction rather than happening on every page.
Scripts run at document_start on matched Roblox pages and the content script covers all frames. — manifest.json:25-48
The bundle supports a group-wall reply action. — assets/inject.js-ryo_DxjW.js:810-821
Popup controls open configured links when used. — popup/popup.js:1-10
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the principal content script is a very large minified/generated bundle that includes third-party code and compact wrappers. The service-worker and some other runtime files are also compressed into single lines.
The main runtime is approximately 1.4 MB and heavily minified/generated. — assets/inject.js-ryo_DxjW.js:1-2418
The background runtime is compressed into one line. — assets/background.js-BHyQp_31.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
Bundled jQuery contains string-to-code evaluation helpers, but the available evidence does not prove that the extension calls them with attacker-controlled or remote text. A definitive negative is not possible from the compressed bundle alone.
Bundled jQuery defines globalEval and _evalUrl-related functionality. — assets/inject.js-ryo_DxjW.js:7
The generated bundle makes complete call-graph verification difficult. — assets/inject.js-ryo_DxjW.js:1-2418
Does it track the websites, pages, searches, or links you visit?
The extension observes Roblox pages and makes Roblox feature requests, but the reviewed code does not establish persistent collection, correlation, or transmission of a user’s general browsing history, searches, or links. URLs and page data used locally by Roblox features are not by themselves tracking.
Execution is limited to Roblox and web.roblox.com pages. — manifest.json:25-48
Requests and status calls are visible, but no dedicated visit-history collection and reporting path is established. — assets/inject.js-ryo_DxjW.js:3-4,2265
Does it create a persistent ID or browser fingerprint to recognize you?
No persistent browser fingerprint or extension-generated tracking ID was found. The code does read the Roblox account’s user ID and name to personalize Roblox features.
Reads Roblox.CurrentUser or page metadata containing userId and name. — retrieveGlobal.js:1-16
Uses cryptographic hashing and Roblox request-signing support, but no clear browser-fingerprint or persistent tracking-ID flow was identified. — assets/inject.js-ryo_DxjW.js:3-4
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension may send normal Roblox session credentials with requests addressed to Roblox, but the reviewed code does not show cookies, tokens, or page contents being copied to an unrelated destination. RoGold services receive feature-related Roblox identifiers and data, not established raw authentication material.
Roblox requests use credentials include, which follows normal same-site request behavior. — assets/inject.js-ryo_DxjW.js:3-4
External calls concern Roblox feature data, identifiers, trading, games, users, or service status. — assets/inject.js-ryo_DxjW.js:532,1103,1347,1373,2025,2084,2265
The cited privileged fetch path explicitly omits credentials. — assets/background.js-BHyQp_31.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records typing, form contents, clipboard contents for collection, or screenshots. Clipboard use is for copying links or IDs into the user’s clipboard.
Clipboard APIs write copied values; they do not read or transmit clipboard contents. — assets/inject.js-ryo_DxjW.js:154,2418
Keyboard and input-related code appears to support UI behavior, not keystroke capture or submission to a remote collector. — assets/inject.js-ryo_DxjW.js:7,877,1347,1404
Can a website or remote server send commands that make the extension take actions?
Scripts running on a matched Roblox page can send page messages that invoke extension-defined handlers, including game-related actions and extension request forwarding. The bridge checks the page origin and message shape, but it still exposes actions to code sharing that Roblox page context.
The main-world bridge accepts same-origin window messages with registered request actions. — assets/request.js-YczTObJn.js:1
The exposed initialization code wires page messages to Roblox GameLauncher methods. — init.js:1-11
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The extension modifies Roblox page presentation and adds navigation/features, including shortened links and custom links. No clear referral-code or advertisement-injection behavior was found.
Adds navigation links and a Shorten URL feature that changes displayed or copied Roblox links. — assets/inject.js-ryo_DxjW.js:2411-2418
Adds promotional links to rogold.live. — assets/inject.js-ryo_DxjW.js:2204-2212
Modifies Roblox UI and can create/delete group-wall content through user-facing features. — assets/inject.js-ryo_DxjW.js:7,810-820
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The reviewed active manifest does not establish a web-traffic interception capability, and the cited rules file is not shown as registered through a declarative-net-request manifest key. Page scripts and fetches are not the same as redirecting browser traffic or changing proxy settings.
The manifest declares no webRequest, declarativeNetRequest, proxy, downloads, or similar traffic-modification permission/key. — manifest.json:1-58
A rules file exists, but no active manifest registration for it is shown. — rules/rules_1.json:1-14
This is a page main-world messaging/request bridge, not proof of browser network interception. — assets/request.js-YczTObJn.js:1
Can it communicate with software on the computer or services running on localhost?
It communicates with Roblox’s web game launcher and can invoke Roblox Studio/game-launch actions through page objects and messages. No localhost or native-computer communication was found.
Calls Roblox.GameLauncher.joinGameInstance, joinMultiplayerGame, and editGameInStudio. — init.js:1-11
Sends Join, PlayPlace, and EditPlace messages and can use a robloxmobile:// URL. — assets/inject.js-ryo_DxjW.js:232,940,980
Uses browser/page storage and cryptography, not localhost endpoints or native messaging. — assets/inject.js-ryo_DxjW.js:3,113-114
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The bundle contains base64 decoding and cryptographic helpers, but the reviewed execution paths show them supporting data formats, request signing, or parsing. No clear hidden-data unpacking followed by arbitrary code execution was established.
Contains hashing, signing, base64 encode/decode, and related library helpers. — assets/inject.js-ryo_DxjW.js:3,49,113
Includes library support for dynamic script evaluation, but no extension-specific remote script execution path was demonstrated. — assets/inject.js-ryo_DxjW.js:7
Injects bundled local scripts into Roblox pages; this is visible code injection, not proof of unpacked remote code execution. — assets/inject.js-ryo_DxjW.js:154,346,940,1018
Can ordinary websites access privileged extension features through messaging or exposed files?
The package exposes some web-accessible files broadly, but that does not grant those pages extension privileges. The request bridge is injected only on Roblox pages and checks the Roblox origin, so ordinary unrelated websites are not shown accessing privileged extension features.
Some resources are web-accessible, including resources matched broadly, while the request and injection scripts are matched only to Roblox domains. — manifest.json:21-41
The bridge requires the window origin to be https://www.roblox.com for its response path and validates same-origin messages. — assets/request.js-YczTObJn.js:1
GameLauncher integration depends on Roblox page globals and is not an arbitrary extension API exposed to unrelated sites. — init.js:1-11
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Features are gated by Roblox page type, stored settings, account or page state, and user interactions, and remote services provide feature data or status. The reviewed code does not establish a date-triggered or user-targeted malicious switch.
Stored settings gate multiple features. — assets/inject.js-ryo_DxjW.js:2378-2418
Behavior varies with Roblox page and feature conditions. — assets/inject.js-ryo_DxjW.js:232,346,940,980
Remote endpoints provide feature data and status, but no conditional malicious activation is established. — assets/inject.js-ryo_DxjW.js:532,1347,1373,2025,2084,2265
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining code or other concealed resource-intensive computation was identified. The extension does perform substantial Roblox API polling and page/UI processing for its features.
Shows polling, caching, and API work for friends, trades, and leaderboards rather than mining. — assets/inject.js-ryo_DxjW.js:861,1379,2025
Cryptographic operations appear tied to Roblox request authentication, not proof-of-work mining. — assets/inject.js-ryo_DxjW.js:3,113
Does it change form fields or where a form sends its information?
The extension changes page navigation and can trigger Roblox actions, but the reviewed source does not clearly demonstrate changing ordinary form destinations or silently rewriting submitted form fields. Some UI event and form-related code is bundled and minified, so coverage is incomplete.
Contains form/event libraries and user-facing group-wall interactions, including a textarea submission. — assets/inject.js-ryo_DxjW.js:7,810-820
Sets UI input values and dispatches input/keyup events for Roblox chat search. — assets/inject.js-ryo_DxjW.js:1058
Changes navigation/link behavior, but this is not itself evidence of modifying form destinations. — assets/inject.js-ryo_DxjW.js:2411-2418