[Sunspark]

Perhaps I am not thinking dastardly enough, but why would a bug appear though? All the user can do is click on links that Valve has provided. If the inputs are from pre-defined sources and within pre-defined parameters, why would anything happen? Nothing is being executed on the end-user side, it's all running off the server. All the client does is renders/plays what it is sent.

[smileybarry]

Steam's in-game overlay has a fully user-controlled browser running on the same engine. Some people use that to open something like a game wiki, and malvertising is a real risk. (In addition to just wanting somewhat secure browsing as a baseline)

Also: I'm not sure if links sent in Steam chat, when viewed in the overlay, open there or with the system browser.