Malicious Twitch chat messages can trigger code execution on OBS Studio

A malicious Twitch chat message could be turned into native code execution on a streamer’s Windows PC by chaining a vulnerable OBS overlay with an outdated Chromium vulnerability.

The attack requires the streamer to be using OBS Studio 32.2.2 or older without changing its default security settings.

The research began after Orange researchers noticed a screenshot posted by a friend showing code from a custom Twitch chat overlay. The overlay inserted viewer messages directly into the page as HTML without sanitization, creating a cross-site scripting (XSS) flaw that allowed a Twitch viewer to execute JavaScript inside the overlay.

Orange began coordinating with the overlay developer in February 2026 and later reproduced the complete attack chain on an updated Windows 11 system in July. The issue was reported to the OBS team on August 19, ahead of public disclosure on September 22.

OBS Studio is a widely used open-source application for livestreaming and video recording. Its Browser Source feature allows streamers to display web-based content such as chat boxes, donation alerts, follower notifications, animations, and other interactive widgets directly inside a scene.

These Browser Sources are rendered using Chromium through the Chromium Embedded Framework (CEF). That meant the vulnerable overlay was not simply displaying text: the XSS allowed attacker-controlled JavaScript to execute inside the Chromium renderer embedded in OBS.

Normally, compromising a Chromium renderer does not immediately provide access to the underlying operating system because the browser sandbox limits what compromised processes can do. However, OBS configured its CEF environment with the Chromium sandbox disabled.

Orange found that OBS Studio 32.2.2 also shipped Chromium 127.0.6533.120 with V8 12.7.224.18, leaving it vulnerable to CVE-2024-7971, a V8 type-confusion vulnerability Google fixed in Chrome 128 in August 2024.

CVE-2024-7971 is known to have been exploited in real-world attacks. Microsoft previously linked exploitation of the vulnerability to the North Korean threat actor it tracks as Citrine Sleet, while CISA added the flaw to its Known Exploited Vulnerabilities catalog.

Orange developed a proof-of-concept exploit for the CEF version bundled with OBS. In the demonstrated chain, a malicious Twitch message triggered the overlay’s XSS, JavaScript exploited CVE-2024-7971 to obtain native code execution inside the Chromium renderer, and the absence of a sandbox meant no additional sandbox-escape vulnerability was required.

The researcher stressed that a default OBS installation is not automatically vulnerable to Twitch messages. The remote entry point depended on a Browser Source that rendered viewer-controlled data as unsanitized HTML. An attacker-controlled webpage loaded directly into an OBS Browser Source or browser dock could potentially provide another path to the browser-exploitation stage.

OBS has since been working on two defenses. The project is upgrading its embedded browser to CEF 128 or newer, with related changes merged into both obs-browser and obs-studio in September. The team is also testing whether the Chromium sandbox can be re-enabled after earlier compatibility problems involving authentication.

Until updated builds are deployed, streamers and overlay developers should treat Browser Source content as untrusted. Viewer messages should be inserted as plain text wherever possible, and any application that genuinely requires HTML should sanitize it before rendering it inside OBS.