[strike]I’m not aware of how this is even possible. I’m asking around right now to figure out if this is widespread. To the thread:
Recently, I’ve seen a couple of users claiming that they’ve been sending messages to “SerialTracker” (now banned account, but that’s not the point | scratch that. you get an error page clicking his name but not pasting his profile page in the address bar manually) containing their .ROBLOSECURITY without actually sending them willingly. Normally, this would be perceived as a password-guessing issue and is usually easily fixed. But it is clearly more than that, and here’s why this is a serious issue:[/strike]
[ul]
[li][strike]The affected users have complex passwords and are careful with what extensions they install[/strike][/li]
[li][strike]The messages are automated in a bot-like process, clearly indicating that this is an automated process and not a user logged in[/strike][/li]
[li][strike]My friend who was recently affected by this issue claims to have not ran any user scripts not installed extensions as of recently[/strike][/li]
[li][strike]If this isn’t downloaded by the user willingly, then this could be a potential XSS vulnerability. I know nothing about those, so I may be talking outta my ass on this one.[/strike][/li]
[li][strike]It’s a user’s .ROBLOSECURITY. What more do I need to say?[/strike][/li]
[li][strike]This is clearly not another user logged in his account; otherwise why would the attacker be sending the cookie data if he/she already had it?[/strike][/li]
[/ul]
[strike]I’m not posting this to get SerialTracker banned. That’s already done. I’m posting this to get what is clearly an exploit noticed and looked in to.
This is my friend’s (ROBLOX user Swordmaker) outbox, and yes that’s his .ROBLOSECURITY; however I walked him through clearing his browser data and changing his password, thus invalidating the cookie:[/strike]
[strike]This needs to be looked in to immediately. I know this isn’t a whole lot to go on, so I will post more reports of this issue here with usernames of affected users as things continue happening.[/strike]
[size=6]Nevermind! What the users kindly neglected to mention was that apparently the lovely extension ROBLOX+ uses your PM system without telling you, but just ever so happily sends item serials that look exactly like a .ROBLOSECURITY, but aren’t
Do excuse me while I strangle the hell out of a select few people for not telling me everything! 
[/size]