Vulnerable OBS overlay and Chromium flaw enable Twitch chat message code execution

A malicious Twitch chat message could be turned into native code execution on a streamer’s Windows PC by chaining a vulnerable OBS overlay with an outdated Chromium vulnerability, as reported by Cyber Insider.

The attack targets streamers using OBS Studio version 32.2.2 or older, exploiting a cross-site scripting (XSS) flaw in custom Twitch chat overlays that insert viewer messages directly into the page as unsanitized HTML. This flaw allows attackers to execute JavaScript within the overlay. Because OBS Studio’s Browser Source feature renders web content using Chromium Embedded Framework (CEF) with its sandbox disabled, the executed JavaScript can then exploit a type-confusion vulnerability in the bundled V8 JavaScript engine (CVE-2024-7971).

This specific vulnerability, known to be exploited in real-world attacks and linked to North Korean threat actors, allows for native code execution without needing a separate sandbox escape. While a default OBS installation is not directly vulnerable, the use of untrusted Browser Source content, such as viewer messages rendered as HTML, creates the attack vector. OBS is addressing this by upgrading its embedded browser and exploring the re-enabling of the Chromium sandbox.

Source: Cyber Insider