Loading story…
Security researchers disclosed multiple code-execution risks affecting Facebook-related software. Facebook Gameroom accepted insufficiently validated game identifiers in a custom URI scheme, allowing attackers to redirect its embedded browser to attacker-controlled Facebook Page content. The client used an obsolete CefSharp/Chromium build—Chromium 63.0.3239.132 while Chromium 86 was current—potentially exposing users to browser vulnerabilities; researchers demonstrated a crash using CVE-2018-6056. Facebook rated the URI-scheme issue High and patched it. A separate Facebook-related report described remote code execution involving MobileIron MDM.
Gameroom also deserialized the user-writable fbgames.settings file with .NET BinaryFormatter, enabling local code execution, although Facebook determined it lacked a practical remote path or privilege-escalation impact. The findings align with broader research showing that unsafe deserialization is not limited to Java binary streams: JSON, XML, and .NET serializers can permit remote code execution when untrusted input controls object types or reaches dangerous constructors, setters, converters, or gadget chains. Organizations should prevent untrusted data from reaching deserializers, remove or tightly constrain polymorphic type handling, and enforce strict type allowlists.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Alvaro Muñoz and Oleksandr Mirosh published research for Black Hat 2017 showing that unsafe JSON, XML, binary, and custom-format deserialization can enable remote code execution. The paper documented insecure configurations and vulnerabilities including Breeze CVE-2017-9424, NancyFX CVE-2017-9785, and DotNetNuke CVE-2017-9822.
Facebook released Gameroom, a Windows-native gaming client that used an embedded Chromium-based browser through CefSharp.
Java deserialization vulnerabilities gained major attention in 2016, according to the research paper.
Frohoff and Lawrence published an Apache Commons-Collections remote-code-execution gadget, accelerating research into Java deserialization attacks.
The research states that Java deserialization vulnerabilities had been known since at least 2011.
Facebook rated as High and patched a Gameroom custom URI-scheme vulnerability that could redirect the embedded browser to attacker-controlled Facebook Page custom-tab content. The issue could expose users to vulnerabilities in Gameroom's outdated Chromium 63 browser engine and enable phishing-style dialogs.
Breeze released version 1.6.5 to fix its unsafe Json.Net deserialization vulnerability.
Researchers reported that Breeze used Json.Net with TypeNameHandling.All and an Object Tag property in SaveOptions, enabling arbitrary code execution tracked as CVE-2017-9424.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
.NET Remoting, a deprecated remote invocation technology still embedded in some enterprise software, remains vulnerable to serious exploitation paths that can lead to **remote code execution**, arbitrary file read/write, and broader host compromise. Research from CODE WHITE and James Forshaw shows that insecure use of `BinaryFormatter` and `SoapFormatter`, weak protections across HTTP, TCP, and IPC remoting channels, and unsafe handling of `MarshalByRefObject` and `ObjRef` data can let attackers trigger deserialization abuse and even force outbound remoting connections. The reports warn that these weaknesses are architectural rather than isolated implementation bugs, leaving legacy deployments exposed even on supported .NET Framework versions. Forshaw's earlier work also demonstrated a **Low Type Filter** bypass that can still work against fully updated `.NET Framework 4.8` remoting services, enabling attackers who know the server URI and can meet any authentication requirements to access files and potentially bootstrap command execution. Public proof-of-concept tooling, including `ExploitRemotingService` and newer offensive additions such as an `ObjRef` gadget and a rogue remoting server, now supports exploitation over TCP and Windows IPC named pipes with functions such as command execution, file upload/download, directory listing, and assembly execution. The combined findings reinforce that organizations should treat exposed or internally reachable .NET Remoting services as high risk and migrate away from the technology.
Aug 1, 2026
Researchers disclosed a class of **one-click remote code execution** flaws in desktop applications that passed user-controlled URLs to the operating system without tightly restricting URI schemes or destinations. The issue affected multiple widely used clients, including **Nextcloud, Telegram Desktop, VLC, OpenOffice, LibreOffice, Mumble, Wireshark**, and several Bitcoin-derived wallets, where a single click on a crafted link could trigger unsafe URI handlers, auto-mount remote shares, or launch attacker-controlled content depending on the operating system and desktop environment. The researchers said exploitation was shaped by platform behavior, and warned that application-level fixes alone were not enough without changes in operating systems and frameworks such as **Qt**. A related case showed how the same pattern led to practical exploitation in **Keybase** on Windows, where specially formatted chat links could display benign text while pointing to arbitrary URI targets. In that scenario, attacker-controlled payment-request content using **Lumens (`XLM`)** could be turned into clickable links that executed local or SMB-hosted programs when clicked, creating a viable one-click RCE path. Vendors responded with a mix of mitigations, including restricting allowed schemes, adding warnings, changing URL-opening behavior, removing separate display fields, and forcing non-`HTTP(S)` links to be prefixed safely, although some products were still awaiting fixes at the time of disclosure.
Jul 24, 2026
Multiple web application vulnerabilities have been disclosed, highlighting the risks associated with misconfigured APIs and file upload functionalities. One report demonstrates how a misconfigured GraphQL endpoint, which accepts `application/x-www-form-urlencoded` content types, can be exploited for Cross-Site Request Forgery (CSRF) attacks. Attackers can craft malicious HTML forms to submit GraphQL mutations, such as changing user email addresses, without proper user consent. Another case details a $100 bug bounty awarded for discovering XSS via malicious PDF uploads and input validation bypasses that led to denial-of-service conditions on a coding platform. Further research describes a blind XML External Entity (XXE) vulnerability in a "Check stock" feature, where attackers can trigger out-of-band DNS and HTTP requests using Burp Collaborator, confirming the presence of XXE. Additionally, a $1,500 bounty was awarded for exploiting an image upload feature at Rockstar Games, where a vulnerable ImageMagick instance enabled a chain of attacks including Local File Inclusion (LFI), Server-Side Request Forgery (SSRF), and remote file access via SMB paths. These incidents underscore the importance of strict input validation, secure API configurations, and careful handling of file uploads in web applications.
Jun 29, 2026