SteamClient is a privileged object used by internal pages in Steam, which has many privileged functions, such as operating the current Browser object, managing window position, downloading any file and etc. In this vulnerability report, it is mentioned that arbitrary file creation (with uncontrollable file content) can be achieved through the list-shortcuts and other functions of steam://devkit-1 . At this point, we can use the arbitrary file reading capability to obtain the content of the token, thus using this functionality to create arbitrary files.