CVE-2025-59489 Arbitrary Code Execution in Unity Runtime

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/
• Blog Title: CVE-2025-59489: Arbitrary Code Execution in Unity Runtime
• Suggested Section: Generic Methodologies & Resources > Mobile Pentesting (Android) > Exported Activities & Intent Abuse (Unity Runtime CLI extras RCE)

🎯 Content Summary

CVE-2025-59489 is an arbitrary code execution vulnerability in the Unity Runtime affecting projects built with Unity 2017.1+. Unity released fixes for 2019.1+ and a Unity Binary Patch tool; developers must update, rebuild, and republish. The finding was validated on Android 16.0 (Android Studio Emulator). Official advisory: Unity Securit...

🔧 Technical Details

Abuse an exported Intent-to-CLI bridge in Unity: When UnityPlayerActivity (or UnityPlayerGameActivity) is exported, any app—and sometimes a website via android.intent.category.BROWSABLE—can send the unity extra. Unity treats this extra as command-line flags. Craft am start ... -e unity "<flags>" (or an intent: URL) to control runtime behavior.

Pre-init native library injection: Supply -xrsdk-pre-init-library <absolute-path> so Unity invokes dlopen(<path>, RTLD_NOW) during early initialization, executing attacker code with the target app’s UID and permissions. The path must resolve within the linker’s permitted namespace (e.g., under /data), and the file need not end with .so if it’s a valid ELF.

Payload placement strategies: Locally, ship a payload library and set andro...

🤖 Agent Actions

Updates completed.

What I added

• New technique in Android Intent Injection page:

  • Added a dedicated section “Unity Runtime: Intent-to-CLI extras → pre-init native library injection (RCE)” covering:
    • Background: Unity’s Intent-to-CLI bridge via the “unity” extra and the undocumented -xrsdk-pre-init-library flag.
    • Root cause details and Ghidra/dlopen snippet.
    • Local exploitation flow via attacker APK and android:extractNativeLibs with ADB PoC.
    • Remote one-click path via BROWSABLE and intent: URL, including linker namespace/SELinux constraints and error example.
    • Bypass via attacker-controlled bytes stored in the app’s private cache; note that .so extension isn’t required if the file is a valid ELF.
    • Hunting/triage tips and developer mitigations.
  • Updated References with:
    • The blog post
    • Unity docs for Android custom activity command-line
    • Unity advisory
    • HEXACON slides on cache-based RCE patterns

• Checklist improvements:

  • Under Static Analysis → Read the manifest → Exported Activities, added a sub-check specifically for Unity apps:
    • “Unity Runtime: exported UnityPlayerActivity/UnityPlayerGameActivity with a unity CLI extras bridge. Test -xrsdk-pre-init-library for pre-init dlopen() RCE. See Intent Injection → Unity Runtime.”
  • Added a References section at the end with the blog link.

Files modified

• src/mobile-pentesting/android-app-pentesting/intent-injection.md
• src/mobile-pentesting/android-checklist.md

Why here

• The technique is a concrete case of exported Activities and Intent abuse on Android. The existing Intent Injection page is the most appropriate place to document the Unity-specific Intent-to-CLI bridge exploitation.
• The checklist is the right place to ensure this Unity pattern is actively considered during assessments.

References added in modified files

• CVE-2025-59489 – Arbitrary Code Execution in Unity Runtime (blog): https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/
• Unity docs – Android custom activity command-line: https://docs.unity3d.com/6000.0/Documentation/Manual/android-custom-activity-command-line.html
• Unity Security Sept-2025-01 advisory: https://unity.com/security/sept-2025-01
• HEXACON slides – cache-based RCE pattern: https://www.hexacon.fr/slides/Calvanno-Defense_through_Offense_Building_a_1-click_Exploit_Targeting_Messenger_for_Android.pdf

No new pages were needed; content integrates cleanly with existing Android mobile pentesting structure.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Mobile Pentesting (Android) > Exported Activities & Intent Abuse (Unity Runtime CLI extras RCE)".

Repository Maintenance:

• MD Files Formatting: 901 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0