Steam Workshop RCE in Meccha Chameleon
- YT :: https://www.youtube.com/watch?v=1DhZkZ_q4Qg
- Original title :: Hacks Hiding in Meccha Chameleon
Walkthrough of Khael Kugler's write-up on a two-click remote code execution in Meccha Chameleon, the hide-in-plain-sight multiplayer game that recently blew up. The chain is: Steam Workshop items are arbitrary folders, the game accepts every file type in them, and an Unreal Engine BeginPlay event can call Launch URL, which lands in ShellExecuteW. Subscribing to a custom map is enough to get owned. Prime frames it as the same class of bug as the Windows Notepad markdown RCE and as npm post-install worms — a distribution channel that ships executables next to the assets, plus a load-time hook that will open anything handed to it.
The delivery mechanism
Meccha Chameleon allows user-generated maps without modding the game. Authors build an Unreal Engine 5 map, package it into a .pak file, and upload to the official Steam Workshop.
A Workshop item is effectively arbitrary file delivery: items are just folders, so anything can go in alongside the map — textures, audio, preview images, and .bat or .exe payloads. Steam's own documentation for item authors warns that a submission tool should accept only the file formats the game client expects to load. Meccha Chameleon accepted everything.
Accepting everything is not by itself the vulnerability. It only means the destructive files reach the disk of everyone who downloads the item.
The trigger
When a lobby starts on a custom map, players who don't have it get a prompt to download. Pressing subscribe is the moment of compromise.
Unreal Engine exposes hookable events, one of which is BeginPlay. BeginPlay can call Launch URL. That method bottoms out in ShellExecuteW, so handing it a file: URI opens whatever the URI points at — including the .bat or .exe that just arrived in the Workshop folder. The map loads without a game restart, the event fires, and the payload runs. Kugler's proof of concept is a plain whoami.
Same shape as the Notepad markdown RCE
Windows Notepad changed for the first time in roughly 20 years and immediately became exploitable. Open a markdown file, click a link that contains a file: URI instead of an HTTP address, and Notepad opens anything.
That one was harder to weaponize because it needed two separate steps: get a malicious program onto the machine somehow, then get the user to click. Meccha Chameleon collapses both steps into one subscribe click — the same underlying primitive, more sinister packaging.
The actual PSA
The reason for the video is not this one game. Many indie games allow custom user content and likely carry an identical exploit, so treat custom content as untrusted code.
The parallel to package managers is direct: developers install npm packages casually, and a post-install script runs unless the security settings prevent it — the mechanism behind the recent Shai-Hulud-style worms. The same exploit shape has now arrived in games.
Prime extends this to agents: you are pulling code onto your machine at a rate never previously possible. Skills can contain hidden HTML that takes advantage of your system, and prompt injection has many entry points. Understand what is being downloaded. Popularity is not safety — Meccha Chameleon was one of the hottest games out there and shipped a massive vulnerability with unknown data exfiltration.
Closing shout-out to Kugler: security research like this is often thankless work.