# code injection, steam chat client

Steam Chat whitelisted CodePen oEmbed, letting a sent link execute attacker JS in privileged Steam context, running steam:// and arbitrary Windows protocol URIs without confirmation.

- Payout: $750
- Severity: medium
- Program: Valve
- Credited: zemnmez
- Disclosed: 2019-01-07
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/411329
- Library page: https://bugbountylibrary.com/r/h1%3A411329
- Tags: domain:desktop impact:rce kind:bounty platform:hackerone sev:medium tech:electron technique:chained technique:recon vuln:misconfiguration vuln:rce

**Target:** Steam chat client oEmbed renderer / steamwebhelper
**Root cause:** oEmbed whitelist trusted CodePen embeds, and embedded pen JS executed inside the privileged Steam Chat browsing context with access to steam:// and custom protocol handlers.
**Steps:**
1. Create a CodePen containing JS payload
2. Send the codepen.io link to a Steam user via chat
3. Victim clicks the link; oEmbed renders and pen JS executes in Steam Chat context
4. Payload calls `steam://run/440` to launch TF2 without confirmation
5. Payload uses `jarfile:[PATH] [PARAMS]`, `JSEFile:`, or `wscript.exe` protocol to execute local programs
6. Open `chrome-devtools://devtools/bundled/inspector.html` to spawn a less-restricted window exposing SteamClient API
**How found:** Noticed Steam Chat supports oEmbed via a whitelist including CodePen; hypothesized pen JS would run in the privileged context, tested with calc.exe and steam://run payloads, then probed the exposed SteamClient API and chrome-devtools URL.
**Exploitation:** Attacker sends a crafted codepen.io link; when the victim clicks it, the whitelisted oEmbed loads the pen and its JS runs in the privileged Steam Chat context, invoking steam:// and Windows custom protocol URIs (jarfile:, JSEFile:) to launch programs without confirmation.
**Escalation:** Chained oEmbed whitelist bypass to privileged JS context, then to arbitrary protocol handler invocation (steam://, jarfile:, JSEFile:) and a chrome-devtools window with broader SteamClient API access.
**Insight:** When a chat/embed client whitelists third-party embed providers, check whether the provider's user-controlled content (pen JS) executes in the host's privileged context; then enumerate OS custom protocol handlers (jarfile:, JSEFile:, wscript.exe) reachable from that context.