Yeah, I know, right? We could make a working web browser with this using HttpService to fetch the HTML of the page, and use HtmlService to display it. But, there are some vulnerabilities, so I can understand why Roblox disabled it. For example, you could use a tracking pixel or a “web bug” in the page to potentially get a user’s IP address and their device info. However, this could be avoided by loading all external content on the page with a proxy. Plus, you usually can’t do much with an IP address. Typically, you can’t see a user’s personal information through an IP address, unless their WHOIS data is visible, which most ISPs hide. You could also potentially display inappropriate or suggestive images, but you can also do this right now by rendering each pixel as a frame inside of a GUI. So theoretically, if Roblox enabled HtmlService, it wouldn’t really pose that much of a threat to their users.
2 Likes