Twitch Chat Message Led to Code Execution on Streamer's PC Due to Vulnerable Overlay

Vulnerability Chain Discovered

A security researcher identified a chain of vulnerabilities that allowed a Twitch chat message to result in native code execution on a streamer's computer. The exploit leveraged a specific chat overlay that rendered viewer messages as raw HTML, an unsandboxed Chromium renderer within OBS Studio, and a known V8 engine vulnerability, CVE-2024-7971.

Unsanitized HTML in Chat Overlay

The initial point of compromise was a custom Twitch chat overlay that displayed viewer messages directly as HTML without proper sanitization. This created a classic Cross-Site Scripting (XSS) vulnerability, allowing an attacker to inject and execute JavaScript code within the context of the OBS Browser Source.

Unsandboxed Chromium and V8 Exploit

OBS Studio's Browser Sources utilize Chromium through the Chromium Embedded Framework (CEF). At the time of the discovery, the Chromium build shipped with OBS ran without its normal sandbox, which typically isolates browser processes from the rest of the system. Additionally, the V8 JavaScript engine within this Chromium version was vulnerable to CVE-2024-7971, a bug already being exploited in the wild. The combination of these factors allowed the injected JavaScript to escalate privileges and achieve native code execution.

Impact on Streamer's Machine

By chaining these vulnerabilities, a malicious Twitch chat message could grant an attacker full control over the streamer's machine. This exploit required no interaction from the streamer and worked with OBS at its default settings, highlighting a significant security risk for users of vulnerable chat overlays and OBS versions.