// HACKER NEWS — CYBERSECURITY
How one Twitch chat message became code execution on a streamer’s PC
A vulnerable chat overlay, an unsandboxed Chromium renderer, and a V8 bug already exploited in the wild were enough to turn viewer-controlled text into native code execution, with OBS itself left at its default settings.
I found a Twitch chat overlay that rendered viewer messages as raw HTML inside an OBS Browser Source. That gives a viewer JavaScript execution inside OBS’s embedded Chromium browser. The latest release of OBS at the time shipped a Chromium build that ran without its normal sandbox, and its V8 version was still vulnerable to CVE-2024-7971, a bug already exploited in the wild.
Put together, the message started in Twitch chat and ended in full control of the streamer’s machine.
A friend of mine had vibecoded a small Twitch chat overlay for OBS and posted a screenshot of it. If you’ve never messed with streaming setups before, a chat overlay is basically just a tiny web page that OBS renders on top of the stream through a Browser Source. It might pull in live chat messages, alerts, donations, or whatever else you want viewers to see on screen.
The screenshot happened to show some of the code too, and one line immediately caught my attention: chat messages were being dropped straight into the page as HTML, without sanitization.
That is a classic XSS. You have probably seen this exact setup before: a viewer controls the message, the overlay treats it as HTML instead of text, and attacker-controlled content can execute inside the page. I’m sure some of you are already shaking your head, with good reason.
It reminded me of an old video by Micode about attacking OBS through its WebSocket interface. The idea was to use a chat XSS as the entry point, then talk to OBS’s local WebSocket server to trigger actions such as switching scenes or stopping the stream.
That route is much less interesting today. OBS WebSocket server is disabled by default, and when enabled it requires a password (it generates one automatically).
I wanted something stronger: one Twitch message, latest OBS, stock configuration, no interaction from the streamer, and code execution on the machine itself.
OBS Browser Sources are powered by Chromium through CEF, the Chromium Embedded Framework. They are used for chat boxes, alerts, donation widgets, animations and custom overlays. The same browser component also powers browser docks and service integrations.