The interesting part IMO is less the XSS on the streamer's overlay, but the fact that it could escape the browser source web page into local code execution (via a combination of OBS disabling the chromium sandbox, and using an outdated CEF version)
Scryptonite•22m ago
Deja Vu. I had to submit an issue and fix a similar issue -- it was similarly Twitch chat overlay XSS, but for that they at least tried to strip the tags (but it was a poor JS implementation of PHP strip_tags), and didn't understand the issue until I crafted a image with onload/onerror to freeze/hang the chat overlay.
dang•59m ago