A malicious Twitch chat message could be turned into native code execution on a streamer’s Windows PC by chaining a vulnerable OBS overlay with an outdated Chromium vulnerability. The attack requires the streamer to be using OBS Studio 32.2.2 or older without changing its default security settings. The research began after Orange researchers noticed a screenshot posted by a friend showing code from a custom Twitch chat overlay. The overlay inserted viewer messages directly into the page as HTML ...