day in the life of an unemployed android girl
- wake up at 1pm at 9% charge
- masturbate
- stick a screwdriver into my joints because im bored
- masturbate again
- more screwdriver time
- run out of battery
What is happening here is he sanding network call that open UI that likely he found, it's a flaw in VRChat networking system (which is 3rd party service called Proton) being client authoritative, meaning all clients listen to other clients network calls. Problem is Unity has a flaw that it's easy to mod and you can modify VRChat to send any network comend which default client was not meant to send. It's main reason why EAC was implemented, not to be inconvinient not letting you use actually useful mods, but because it let you do things like this. And this can't be fixed without revamping network system in VRChat which also means braking compatibility with not only Udon code in worlds but also avatar system.
Thats said in this case it's a bug, two possibilities:
-Either in VRChat client code there that opens URL window that can network called
-Or there function in Udon code of the world that force open URL and he foudn it and calling that function
Option 1 is a bug on VRChat client code, there some network callable function in client that trigger URL field, which sould not be possible as this UI should only open when user interact with text field
Option 2 means it's a bug in the world Udon code, that said as far as i know there no way to force focus URL text field with Udon script and normal scripts like image pads and video players usually don't even need to do that, you can only force open group window as far as i know. VRChat even thru it would been very useful for world creators don't let you do that to prevent this kind of situation. So this options seem not likely to me. But if thats the case world creator potentially can fix this. Also if this is the case, this exploit can work only in this world or whatever world contain prefab that has this bug.
Either way it's bug, insted of focusing on person doing it, raport a bug to VRChat that user with modified client can force open URL text editor with ready text, also include logs as it can contain useful information what this user is doing to open that window on other clients. Because yes they can ban that person but it does not fix problem at the core which someone else can exploit.