Security researchers have disclosed a zero-click exploit chain that allowed attackers to gain full control of a streamer’s computer using a single Twitch chat message, taking advantage of unsanitized chat overlays and disabled security features in popular broadcasting software OBS Studio.
The vulnerability, detailed in a technical report published Tuesday by Dylan Iffrig-Bourfa of Orange Cyberdefense Switzerland (SCRT Team), highlights how an unpatched browser engine and a disabled sandbox environment inside OBS Studio turned standard streaming widgets into major security risks.
The Exploit Chain: From Chat to Code Execution
The attack relies on a three-stage exploit chain that requires no user interaction or elevated privileges beyond a streamer displaying a vulnerable chat overlay on screen:
- Cross-Site Scripting (XSS): The entry point begins with a poorly coded Twitch chat overlay—a web component loaded into OBS via a “Browser Source.” Because the overlay inserted viewer messages directly into the page as raw HTML rather than sanitized text, sending a malicious script into Twitch chat executed JavaScript inside OBS’s internal browser.
- Outdated Engine: OBS Studio utilizes the Chromium Embedded Framework (CEF) to render web sources. In version 32.2.2, OBS shipped with an outdated Chromium version (127.0.6533.120) containing a known V8 JavaScript engine type-confusion vulnerability tracked as CVE-2024-7971.
- Disabled Sandbox: While browser exploits typically only grant access to a restricted “renderer” process, OBS Studio had disabled Chromium’s built-in security sandbox (
no_sandbox = true). As a result, exploiting the V8 bug instantly granted the attacker native code execution on the streamer’s Windows machine.
CVE-2024-7971 is a high-severity flaw originally patched by Google in August 2024 after Microsoft observed it being actively exploited in zero-day attacks by the North Korea-linked threat group Citrine Sleet. Because OBS’s browser component was roughly two years behind upstream Chromium security updates, the exploit remained viable within the broadcasting software.
“The interesting part is not the XSS itself,” Iffrig-Bourfa wrote in the disclosure. “It is where attacker-controlled web content is running… If that JavaScript can exploit V8 and become native code execution inside the renderer, there is no Chromium sandbox left to escape.”
Fixes Underway in Upcoming OBS Update
The researcher noted that the vulnerability was tested on stock settings without requiring the user to enable administrative rights or OBS’s optional WebSocket interface.
Following a responsible disclosure process initiated in August 2026, the open-source OBS Studio development team acknowledged the findings and confirmed that mitigation steps were already in progress.
According to the project’s repository, OBS maintainers merged code updates on September 10 and September 17, 2026 (PR #523 in obs-browser and PR #13890 in obs-studio). These changes update the underlying browser to CEF 128+ and re-enable the Chromium renderer sandbox—two measures slated for official release in OBS Studio 33.0.
The sandbox had previously been disabled in OBS due to authentication issues with certain third-party streaming integrations, a problem developers believe is now resolved with newer CEF builds.
Guidance for Streamers and Developers
Security experts advise content creators to review their current scene setups immediately. While the core OBS update is finalized for the upcoming release, streamers are urged to:
- Audit Browser Sources: Ensure all third-party chat boxes, alert widgets, and donation overlays properly sanitize user inputs.
- Avoid Raw HTML Rendering: Overlay developers must render incoming viewer messages strictly as plain text or run them through robust HTML sanitization libraries before rendering.
- Update Software: Apply OBS Studio updates immediately as version 33.0 and subsequent security patches become available.
Source: SCRT
Buy me a Ko-fiSupport this blog ❤️
