← Sunday, September 27, 2026SecurityVulnerability

A Twitch overlay chain turned chat text into code execution on a streamer’s PC

blog.scrt.ch 6 min read Editor score 7/10

Viewer text ran as raw HTML in an OBS browser source, where an unsandboxed Chromium renderer and a V8 bug enabled native code execution. The chain illustrates how an untrusted-content feature can expose a desktop host.

What: A Twitch chat overlay rendered viewer messages as raw HTML inside OBS’s embedded Chromium browser.
How: The message enabled JavaScript execution; an unsandboxed renderer and a V8 bug then allowed native code execution on the streamer’s machine.
Why it matters: Systems that render untrusted content need sanitization and isolation: a browser component without its sandbox can turn an injection flaw into host compromise.

Viewer-controlled chat text passes through the overlay and embedded browser to the host machine. Sketched from the article's own text.

Read on blog.scrt.ch → Hacker News · 25 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.