Collected research

Steam Browser Protocol Insecurity

Luigi Auriemma and Donato Ferrante · revuln.com

ReVuln turns local Steam bugs remote through the steam:// URL handler, which most browsers invoke with no warning or a truncated one, and which Steam's own browser can be made to follow via a YouTube link bounce. The paper reports an integer overflow in the retailinstall TGA splash loader plus command-line injection into Source, Unreal, APB Reloaded and MicroVolts.

Record

Researcher

Luigi Auriemma and Donato Ferrante

Published by

revuln.com

Format

Whitepaper

Topic

Browser

In the archive

• Collected in the 2012 research round

Tags

• rce
• command-injection
• path-traversal
• attack-chain
• case-study
• url-parsing
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Luigi Auriemma and Donato Ferrante, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 6 August 2026.