Unity Patches 8-Year-Old Flaw Affecting 70% of Top Mobile Games

Unity Technologies has released patches to address a critical vulnerability in its widely used game engine, which could allow local code execution on Android, Windows, macOS, and Linux platforms. The flaw, tracked as CVE-2025-59489 with a CVSS score of 8.4, affects Unity projects dating back to 2017.1 and was disclosed on October 2, 2025, with no evidence of exploitation in the wild title1^[1]. The vulnerability arises from unsafe file-loading behavior in the Unity Runtime, enabling attackers to inject malicious libraries into vulnerable applications via Android intents or command-line arguments title2^[2].

The exploit leverages Unity's intent handling system on Android, where malicious apps can force vulnerable Unity applications to load attacker-controlled native libraries (.so files). This allows arbitrary code execution under the permissions of the targeted app, potentially accessing sensitive data such as location, camera feeds, or in-game credentials title3^[3]. While Android's SELinux protections limit remote exploitation, local attacks remain viable, particularly if users install malicious apps from third-party sources title4^[4].

Unity has distributed patches to developers across supported and out-of-support versions, including Unity 6 LTS, 2022.3.67f2, and 2019.1, among others. A binary patching tool has also been provided for legacy projects that cannot be rebuilt title5^[5]. Platform partners, including Google and Microsoft, have implemented additional safeguards. Google Play's malware scanning and Microsoft Defender updates now detect and block exploitation attempts, while Valve has added mitigations for the Steam client title6^[6].

The vulnerability impacts approximately 70% of top mobile games, including titles like Among Us and Pokémon GO title3^[3]. Developers are urged to recompile projects with patched Unity Editor versions or apply the binary patcher to existing builds. Users are advised to update Unity-based apps through official app stores, disable sideloading, and review app permissions. For crypto-related apps, users should ensure seed phrases are not stored in plaintext and employ hardware wallets for larger balances until all updates are applied title2^[2].

Unity emphasized that the vulnerability's impact is confined to the privileges of the affected app, with no evidence of widespread exploitation. However, the company stressed the urgency of updates, given the engine's ubiquity across platforms. Security firm GMO Flatt highlighted that the flaw's potential for privilege escalation makes it a high-risk issue, particularly for apps integrating wallet SDKs or WalletConnect sessions title4^[4].

Developers using older Unity versions (2017.x–2018.x) face additional challenges, as tamper-proofing or anti-cheat solutions may prevent the use of the binary patcher. In such cases, full recompilation with patched Editor versions is required title8^[8]. For Linux users, Unity clarified that the risk profile is lower, and no patching tool has been released for this platform title7^[7].

The response has been coordinated across industry stakeholders, with Microsoft, Google, and Valve issuing rapid mitigations. Unity's proactive disclosure and patching efforts aim to minimize user exposure, though the scale of affected applications-spanning eight years of game development-poses operational challenges for developers. As the fix rolls out, users are advised to remain vigilant, particularly on Android, where sideloading remains a vector for malicious apps title1^[1].