Dylan Iffrig-Bourfa spotted an XSS in a friend’s Twitch chat overlay from a screenshot. Chat messages were dropped into the page as raw HTML. Normally that’s a contained bug — OBS’s WebSocket server is disabled by default and password-gated now — but a Browser Source isn’t a web page, it’s a full Chromium instance embedded in OBS through CEF, running on the streamer’s machine.

Three individually survivable conditions composed into zero-click remote code execution:

  • The overlay rendered viewer-controlled text as HTML, unsanitized — the entry point, and what makes the chain remote.
  • OBS initializes its embedded CEF with no_sandbox = true, still present in obs-browser’s source.
  • OBS 32.2.2 shipped Chromium 127 / V8 12.7.224.18, vulnerable to CVE-2024-7971 — a type confusion patched in Chrome 128 in August 2024, documented as exploited by the actor Microsoft tracks as Citrine Sleet, and listed in CISA’s Known Exploited Vulnerabilities catalog.

The composition is the finding. The XSS gives the viewer JavaScript inside CEF. The V8 bug turns that into native code execution in the renderer. With the Chromium sandbox disabled, there is no second boundary left to cross — in Microsoft’s observed attack, the attackers still needed a sandbox escape afterwards.

What “default configuration” does and doesn’t mean: no WebSocket setup, no admin rights, no sandbox option changed by the user, no click from the streamer. But this isn’t a claim that a fresh OBS install is remotely exploitable — the vulnerable overlay is required to get attacker-controlled content into the browser. More generally, anything loaded into a Browser Source or browser dock could start directly at the browser-exploitation stage; the XSS is just what makes this variant remote.

The fixes are two, both in flight:

  • Upgrade the embedded browser to CEF 128+, long blocked because Chrome’s new runtime didn’t support the off-screen rendering OBS relies on. obs-browser PR #523 merged 2026-09-10; obs-studio PR #13890 merged 2026-09-17.
  • Re-enable the CEF sandbox, being tested in the same update. It was originally turned off because it broke auth for some service integrations.

The detail that makes this more than an OBS bug: Chromium 127 reached stable in July 2024, so the engine was roughly two years behind on a component whose entire job is rendering untrusted web content — and the sandbox was off the entire time. That’s not unique to OBS; every app embedding a browser inherits an update treadmill it doesn’t fully control, and each isolation layer is an opt-in the author has to keep re-justifying.

The one thing in every overlay author’s hands today: if a chat message is text, render it as text. If you genuinely need HTML, sanitize it properly.