Posted on October 3, 2025 • 6 minutes • 1067 words Table of contents Introduction TL;DR About Unity Technical Details Unity’s Intent Handler xrsdk-pre-init-library Command Line Argument Attack Scenarios Local Attack Remote Exploitation via Browser SELinux Restrictions Requirements for Remote Exploitation Demonstration Conclusion Shameless plug Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. In May 2025, I participated in the Meta Bug Bounty Researcher C...