# Applying Offensive Reverse Engineering to Facebook Gameroom

Facebook Gameroom's fbgames:// URI handler failed to validate the gameid slug and parsed a canvas_params JSON param, letting attackers load arbitrary attacker-controlled Facebook canvas apps in the embedded outdated Chromium.

- Payout: Research
- Severity: high
- Program: Facebook Gameroom
- Write-up by: Eugene Lim
- Disclosed: 2021-02-02
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/applying-offensive-reverse-engineering-to-facebook-gameroom/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-applying-offensive-reverse-engineering-to-facebook-gameroom
- Tags: area:os domain:desktop impact:integrity kind:research platform:research sev:high tech:chromium tech:dotnet technique:reverse-engineering technique:source-review vuln:open-redirect vuln:rce

**Target:** Windows desktop client (CefSharp/Chromium embedded browser) custom URI scheme handler
**Root cause:** GetGameSchemeId extracts the first path slug without validating it is a numeric game ID, and GetCanvasParamsFromQuery deserializes a canvas_params JSON dict into URL query params, so an attacker controls the URL loaded in the embedded browser.
**Steps:**
1. Decompile FacebookGameroom.exe with dnSpy; inspect Program.cs OnInstanceAlreadyRunning and SchemeHelper.GetSchemeType/GetGameSchemeId/GetCanvasParamsFromQuery.
2. Note GetGameSchemeId takes only the first slug of fbgames://gameid/<slug> and does not validate it as an ID.
3. Note GetCanvasParamsFromQuery reads `canvas_params` query param, JSON-deserializes it, and appends entries as query params to the resulting URL.
4. Craft `fbgames://gameid/evilPage?canvas_params={"sk":"app_123456"}` which resolves to `https://apps.facebook.com/evilPage/app/123456` in the native window.
5. Host attacker JS in a Facebook canvas app tab; it executes in the embedded Chromium 63.0.3239.132.
6. Optionally trigger CVE-2018-6056 type-confusion PoC to crash the engine, or show native-looking MessageBoxes for phishing.
**How found:** After a dead-end BinaryFormatter deserialization RCE in fbgames.settings (rejected as out of threat model), pivoted to the fbgames:// custom URI scheme; traced launch_local (blocked by confirmation dialog) then gameid path, spotting missing ID validation and the canvas_params JSON-to-query-param gadget.
**Exploitation:** Victim clicks an fbgames:// link; Gameroom parses it, builds https://apps.facebook.com/evilPage/app/123456 via the canvas_params sk injection, and loads attacker-controlled JavaScript in the outdated embedded Chromium, enabling browser exploits, phishing dialogs, or attempts to read cached credentials.
**Escalation:** Chained URI-scheme slug injection with canvas_params query injection to reach attacker JS, then leveraged the 3-year-old Chromium (63 vs 86) for CVE-2018-6056 type confusion and native MessageBox phishing.
**Insight:** In Electron/CefSharp apps, audit custom URI scheme handlers for slug/ID validation gaps and any param that gets JSON-decoded into URL query params (canvas_params) — that gadget lets you smuggle query strings past path-truncation logic to reach attacker JS in the embedded browser.