Malicious Twitch chat messages can trigger code execution on OBS Studio
2 hours ago
- A malicious Twitch chat message can achieve native code execution on a Windows PC by exploiting an OBS overlay's cross-site scripting (XSS) flaw combined with an outdated Chromium vulnerability (CVE-2024-7971).
- The attack targets OBS Studio version 32.2.2 or older with default security settings, where the Chromium sandbox is disabled, removing a key layer of protection.
- The XSS vulnerability in a custom overlay allows attacker-controlled JavaScript to run inside OBS's Browser Source, which then exploits CVE-2024-7971 to gain native code execution without needing a sandbox escape.
- OBS is upgrading its embedded Chromium to CEF 128+ and testing re-enabling the sandbox, but until updates roll out, streamers should treat Browser Source content as untrusted and sanitize viewer messages as plain text.