Steam and Microsoft warn of Unity flaw exposing gamers to attacks

Unity Engine vulnerability CVE-2025-59489 allows unsafe file loading and local file inclusion that can result in arbitrary code execution on Android (via malicious apps abusing Intents) and potential privilege escalation on Windows; vendors (Unity, Valve/Steam, Microsoft) have issued advisories, recommended mitigations include updating the Unity Editor/runtime or replacing patched UnityPlayer binaries, and some out-of-support versions will not be patched — no active exploitation was reported at the time of the bulletin.