Back Scworld

Vulnerable OBS overlay and Chromium flaw enable Twitch chat message code execution

Scworld • September 25, 2026

A malicious Twitch chat message could be turned into native code execution on a streamer’s Windows PC by chaining a vulnerable OBS overlay with an outdated Chromium vulnerability, as reported by Cyber Insider.

The attack targets streamers using OBS Studio version 32.2.2 or older, exploiting a cross-site scripting (XSS) flaw in custom Twitch chat overlays that insert viewer messages directly into the page as unsanitized HTML. This flaw allows attackers to execute JavaScript within the overlay. Because OBS Studio’s Browser Source feature renders web content using Chromium Embedded Framework (CEF) with its sandbox disabled, the executed JavaScript can then exploit a type-confusion vulnerability in the bundled V8 JavaScript engine (CVE-2024-7971).

This specific vulnerability, known to be exploited in real-world attacks and linked to North Korean threat actors, allows for native code execution without needing a separate sandbox escape. While a default OBS installation is not directly vulnerable, the use of untrusted Browser Source content, such as viewer messages rendered as HTML, creates the attack vector. OBS is addressing this by upgrading its embedded browser and exploring the re-enabling of the Chromium sandbox.

Source: Cyber Insider

SC Staff September 25, 2026

Laura French September 25, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Twitch Chat Messages Exploit OBS Studio via Chromium Vulnerability A vulnerability in OBS Studio allows malicious Twitch chat messages to execute native code on streamers' Windows PCs. This exploit targets users running OBS Studio version 32.2.2 or older, leveraging a cross-site scripting (XSS) flaw in custom overlays that render viewer messages as unsanitized HTML. The attack exploits CVE-2024-7971, a type-confusion vulnerability in the V8 JavaScript engine, which has been linked to real-world attacks by North Korean threat actors. The attack chain involves executing JavaScript within the OBS overlay, which can then exploit the outdated Chromium engine due to the disabled sandbox. While default installations of OBS are not vulnerable, using untrusted Browser Source content creates a significant risk. The OBS team is currently working on security enhancements to mitigate this vulnerability. The issue was reported on August 19, 2026, and publicly disclosed on September 22, 2026. 2 sources 75

Extracted Entities

Vulnerable OBS overlay and Chromium flaw enable Twitch chat message code execution

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (3)