Twitch Chat Messages Exploit OBS Studio via Chromium Vulnerability

• •Malicious Twitch messages can exploit OBS Studio versions 32.2.2 and older.
• •The attack leverages CVE-2024-7971, a known type-confusion vulnerability.
• •OBS is upgrading its security features to address this critical flaw.

A vulnerability in OBS Studio allows malicious Twitch chat messages to execute native code on streamers' Windows PCs. This exploit targets users running OBS Studio version 32.2.2 or older, leveraging a cross-site scripting (XSS) flaw in custom overlays that render viewer messages as unsanitized HTML. The attack exploits CVE-2024-7971, a type-confusion vulnerability in the V8 JavaScript engine, which has been linked to real-world attacks by North Korean threat actors. The attack chain involves executing JavaScript within the OBS overlay, which can then exploit the outdated Chromium engine due to the disabled sandbox. While default installations of OBS are not vulnerable, using untrusted Browser Source content creates a significant risk. The OBS team is currently working on security enhancements to mitigate this vulnerability. The issue was reported on August 19, 2026, and publicly disclosed on September 22, 2026.