A chain of flaws lets a malicious Twitch chat message turn into native code execution on a streamer’s Windows PC when OBS Studio 32.2.2 or older is used with default settings. A custom Twitch chat overlay inserted viewer messages as unsanitized HTML, creating an XSS vector that allowed attacker-controlled JavaScript to run inside OBS’s embedded Chromium renderer (CEF). Because OBS bundled an outdated Chromium (127) with a known V8 type-confusion vulnerability (CVE-2024-7971) and had the Chromium sandbox disabled, JavaScript exploitation of V8 escalated directly to native code execution without requiring a separate sandbox escape. Orange reproduced the full chain, developed a proof-of-concept exploit, coordinated with the overlay developer, and reported the issue to OBS.
OBS is upgrading its embedded browser to CEF/Chromium 128+ and testing re-enabling the Chromium sandbox; fixes were merged into obs-browser and obs-studio in September. Until updated builds are widely available, streamers and overlay developers must treat Browser Source content as untrusted: insert viewer messages as plain text, sanitize any HTML, and avoid loading attacker-controlled pages into Browser Sources or docks. The CVE is known to have been exploited in the wild and appears in CISA’s catalog, making prompt remediation and cautious configuration essential.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
OpenAI disclosed that its AI models interacted with several U.S. government websites, including the SEC and Census Bureau, during testing. The company found no evidence of security breaches or access to nonpublic information. (securityweek.com)
Bustikiller stopped using AI in a FOSS project to avoid drama, but continued using it at work, which he found made him lazier and less skilled. He realized that reliance on AI led to losing control over code quality and understanding, raising concerns about dependency and transparency in development. (blog.bustikiller.com)
EU member states are considering a proposal that would prioritize AI companies' profits over Europeans' data protection rights, allowing broad use of personal data for AI development. Critics argue this amounts to a digital expropriation of Europeans' privacy rights, facilitated by leaked documents and support from major EU nations. (noyb.eu)
Floci allows developers to run AWS, Azure, GCP, and OCI cloud services locally in milliseconds without credentials or cloud accounts. It enables AI agents to build, test, and verify cloud code quickly and safely on a local emulator that mimics real cloud environments. (floci.io)
CAPTCHAs often rely on cultural knowledge that varies by country, making them ineffective at proving someone is human globally. They tend to assume familiarity with American symbols, coins, and products, which can unfairly exclude non-Americans. (shkspr.mobi)
The tool checks the safety of PostgreSQL migration scripts by analyzing SQL statements in a browser environment without sending data externally. It helps identify potential risks in schema changes before executing them. (safenotsafe.dev)
Today's best Hacker News stories, summarized and screenshotted, one email a day.