--- title: Hacks Hiding in Meccha Chameleon | daily.dev description: A security researcher named Kale Kugler discovered a two-click remote code execution vulnerability in the game Mecha Chameleon, exploiting Steam Workshop's... canonical: https://daily.dev/posts/hacks-hiding-in-meccha-chameleon-g7t2drtd0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hacks Hiding in Meccha Chameleon | daily.dev og:description: A security researcher named Kale Kugler discovered a two-click remote code execution vulnerability in the game Mecha Chameleon, exploiting Steam Workshop's... og:url: https://daily.dev/posts/hacks-hiding-in-meccha-chameleon-g7t2drtd0 og:image: https://api.daily.dev/og/posts/G7T2dRTD0.png og:image:alt: Hacks Hiding in Meccha Chameleon og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hacks Hiding in Meccha Chameleon **[ThePrimeTime](https://daily.dev/sources/primeagen)** · 10 min read · 10 upvotes · 0 comments ## Summary A security researcher named Kale Kugler discovered a two-click remote code execution vulnerability in the game Mecha Chameleon, exploiting Steam Workshop's arbitrary file delivery to plant malicious executables that get triggered via Unreal Engine's begin play event calling ShellExecuteW on a file URI. The technique closely mirrors the earlier Windows Notepad markdown RCE, where clicking a link containing a file URI instead of an HTTP address would launch arbitrary local files. The commentary draws a broader parallel to npm package postinstall script exploits and warns that AI agents downloading and executing content pose similar emerging risks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Mecha Chameleon remote code execution exploit work through Steam Workshop maps? Steam Workshop items are just folders, so a malicious map submission could bundle a destructive or credential-stealing executable alongside legitimate map files. When a player joined a lobby using that custom map and clicked subscribe to download it, an Unreal Engine 'begin play' event fired ShellExecuteW to open a file URI pointing at the downloaded malicious file, executing it without any restart or extra click needed. _Developers evaluating user-generated content platforms can follow security writeups like this on daily.dev before shipping similar upload features._ ### How is the Mecha Chameleon exploit similar to the Windows Notepad markdown RCE? Both exploits abuse the same underlying mechanism: a link or file reference that isn't an HTTP address but a file URI, which Windows will open via ShellExecuteW regardless of file type. The Notepad markdown RCE required a malicious program already on disk before a clicked link could trigger it, while the Mecha Chameleon exploit delivered the malicious file and triggered execution together through the Steam Workshop download and begin-play event. _Teams tracking file-URI and ShellExecuteW style vulnerabilities across products can follow related security research on daily.dev._ ## Similar posts on daily.dev - [MECCHA CHAMELEON can't hide from the RCE](https://daily.dev/posts/meccha-chameleon-can-t-hide-from-the-rce-pg0ho2oxw) · Aikido Security · 0 upvotes · 0 comments - [Screeps: How A Game About Programming Sold Its Players a Remote Access Trojan](https://daily.dev/posts/screeps-how-a-game-about-programming-sold-its-players-a-remote-access-trojan-nitovvifa) · Lobsters · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#windows](https://daily.dev/tags/windows), [#unreal-engine](https://daily.dev/tags/unreal-engine) [View this post on daily.dev](https://daily.dev/posts/hacks-hiding-in-meccha-chameleon-g7t2drtd0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hacks Hiding in Meccha Chameleon","url":"https://daily.dev/posts/hacks-hiding-in-meccha-chameleon-g7t2drtd0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hacks-hiding-in-meccha-chameleon-g7t2drtd0"},"datePublished":"2026-08-17T13:37:33.441Z","dateModified":"2026-09-13T19:07:42.833Z","description":"A security researcher named Kale Kugler discovered a two-click remote code execution vulnerability in the game Mecha Chameleon, exploiting Steam Workshop's...","image":"https://i.ytimg.com/vi/1DhZkZ_q4Qg/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/1DhZkZ_q4Qg/sddefault.jpg","isAccessibleForFree":true,"articleSection":"ThePrimeTime","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ThePrimeTime","logo":"https://media.daily.dev/image/upload/s--J5-GjDeo--/f_auto/v1704628081/logos/primeagen.jpg","url":"https://daily.dev/sources/primeagen"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hacks-hiding-in-meccha-chameleon-g7t2drtd0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,windows,unreal-engine","timeRequired":"PT10M","video":{"@type":"VideoObject","name":"Hacks Hiding in Meccha Chameleon","description":"A security researcher named Kale Kugler discovered a two-click remote code execution vulnerability in the game Mecha Chameleon, exploiting Steam Workshop's...","thumbnailUrl":"https://i.ytimg.com/vi/1DhZkZ_q4Qg/sddefault.jpg","uploadDate":"2026-08-17T13:37:33.441Z","duration":"PT10M","url":"https://api.daily.dev/r/G7T2dRTD0","embedUrl":"https://www.youtube.com/embed/1DhZkZ_q4Qg"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ThePrimeTime","item":"https://daily.dev/sources/primeagen"},{"@type":"ListItem","position":3,"name":"Hacks Hiding in Meccha Chameleon"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hacks-hiding-in-meccha-chameleon-g7t2drtd0#faq","mainEntity":[{"@type":"Question","name":"How did the Mecha Chameleon remote code execution exploit work through Steam Workshop maps?","acceptedAnswer":{"@type":"Answer","text":"Steam Workshop items are just folders, so a malicious map submission could bundle a destructive or credential-stealing executable alongside legitimate map files. When a player joined a lobby using that custom map and clicked subscribe to download it, an Unreal Engine 'begin play' event fired ShellExecuteW to open a file URI pointing at the downloaded malicious file, executing it without any restart or extra click needed. Developers evaluating user-generated content platforms can follow security writeups like this on daily.dev before shipping similar upload features."}},{"@type":"Question","name":"How is the Mecha Chameleon exploit similar to the Windows Notepad markdown RCE?","acceptedAnswer":{"@type":"Answer","text":"Both exploits abuse the same underlying mechanism: a link or file reference that isn't an HTTP address but a file URI, which Windows will open via ShellExecuteW regardless of file type. The Notepad markdown RCE required a malicious program already on disk before a clicked link could trigger it, while the Mecha Chameleon exploit delivered the malicious file and triggered execution together through the Steam Workshop download and begin-play event. Teams tracking file-URI and ShellExecuteW style vulnerabilities across products can follow related security research on daily.dev."}}]} ```