A vulnerable Twitch chat overlay combined with an unsandboxed Chromium renderer and a known V8 vulnerability enabled remote code execution on streamers' machines through OBS. The chat overlay rendered viewer messages as raw HTML without sanitization, creating a classic XSS vulnerability. Since OBS Browser Sources use Chromium Embedded Framework with sandboxing disabled, and the bundled Chromium version was vulnerable to CVE-2024-7971, attackers could escalate from JavaScript execution to native code execution.

The attack chain required no streamer interaction and worked against default OBS configurations. A viewer could send a specially crafted Twitch message that would execute arbitrary JavaScript within the embedded browser. Combined with the unpatched V8 engine and missing Chromium sandbox, this led to full system compromise.

The vulnerability was discovered when a friend's custom chat overlay code was found inserting unsanitized chat messages directly into HTML. While OBS Web Socket interfaces now require passwords by default, the browser-based attack vector remained exploitable. The researcher demonstrated the issue against OBS 32.2.2 with stock settings.