A deserialization gadget chain is a sequence of reachable methods, callbacks, or object hooks that turns object reconstruction into unintended code execution. During deserialization, a program rebuilds objects from bytes; if the runtime has the right classes loaded, attacker-controlled data can flow through ordinary methods that were never meant to be security boundaries.
This matters because it lets a single unsafe deserialization call become remote code execution without a memory-corruption bug. In practice, attackers look for libraries and application code that expose “gadgets” such as special constructors, finalizers, or magic methods. Defenders reduce the risk by avoiding deserialization of untrusted input, preferring primitive formats like JSON, restricting what classes can be rebuilt, and keeping deserialization inside a trusted boundary with authentication and input validation.