Loading story…
A vulnerability in MECCHA CHAMELEON let a malicious Steam Workshop custom-map lobby host execute attacker-controlled code on a joining player's Windows system. The game's Blueprint logic exposed an Unreal Engine recording-output function that attackers could use to write arbitrary files through controlled paths; a null-character path-handling discrepancy bypassed Unreal's automatic .wav filename suffix.
Researchers demonstrated a two-click attack chain by embedding an HTML Application payload in uncompressed PCM WAV data, writing it to the Windows Startup folder, and relying on mshta.exe to run the payload after the victim restarted the system. Version 4.0.0 remediated the issue by preventing StopRecordingOutput from creating files; researchers reported finding no Workshop maps exploiting this specific flaw.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
MECCHA CHAMELEON version 4.0.0 was released on 20 August 2026 with a patch for the vulnerability. Following the change, StopRecordingOutput no longer creates files, including legitimate recording-output files.
The developer replied to the researchers on 17 August 2026 and said the reported issue would be fixed.
Between 11 and 17 August 2026, researchers attempted to report a custom-map vulnerability through Twitter, Discord, Steam Support, and the developer email address. The flaw allowed a malicious lobby host's Workshop map to use Blueprint-accessible recording output to write an attacker-controlled payload into a joining player's Windows Startup folder, leading to code execution after restart.
Researchers reviewed Steam Workshop maps and found no maps exploiting this specific vulnerability.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers found that **Dota 2** shipped an outdated, unsandboxed build of Google’s **V8 JavaScript engine**, allowing attackers to achieve remote code execution through malicious JavaScript embedded in custom game modes. One Steam-published custom mode directly exploited **`CVE-2021-38003`**, a V8 flaw tied to a Chromium issue involving `JSON.stringify`, while three other malicious modes used a quieter backdoor that fetched and executed attacker-controlled JavaScript from a command-and-control server. The malicious game modes were all published by the same author and targeted players who joined those custom matches, turning the game’s Panorama client-side JavaScript into a path across a security boundary and onto players’ systems. After disclosure, Valve upgraded V8, removed the malicious game modes from Steam, notified affected users, and added mitigations; the company said fewer than 200 players were impacted.
Aug 15, 2026
A critical heap-based buffer overflow in Konami's **Metal Gear Online 3** let malicious Steam lobby hosts execute arbitrary code on a victim's computer when the victim joined the lobby. Tracked as **CVE-2026-19874** and documented in CERT/CC advisory **VU#728712**, the issue affected `mgsvmgo.exe` version 1.1.2.8: an oversized `kick_num` value in lobby metadata could write beyond the buffer used for kicked-player Steam IDs, corrupting memory and potentially Steamworks callback structures. Konami fixed the vulnerability in version 1.1.2.9. The company also raised required server and lobby version numbers, preventing older vulnerable clients from connecting to online services and reducing exposure to attacker-controlled lobbies.
Aug 27, 2026
SafeBreach Labs disclosed **CVE-2025-59199**, a Windows 11 sandbox escape that allows a low-integrity process to gain medium-integrity code execution and perform arbitrary file writes after a single user click. The attack, dubbed **"Click Or Trick,"** chains weaknesses across several Windows components rather than exploiting one isolated flaw, combining a misconfigured COM object, Windows app identity and toast notification behavior, Snipping Tool URI handling, URI decoding quirks, and Microsoft Teams' exposed Chromium remote debugging interface. Researchers showed an attacker could launch a medium-integrity COM server from a low-integrity context, spoof a trusted toast notification, append attacker-controlled command-line arguments to legitimate applications, and then abuse the Chrome DevTools Protocol to write files outside the sandbox. Microsoft assigned the issue a **CVSS 7.8** score after it was reported on July 13, 2025, and released a patch on October 14, 2025; the findings underscore how security gaps at the boundaries between unrelated Windows subsystems can be combined into a practical sandbox escape chain.
Jun 29, 2026