‹ BackHN Continuity

Thread

How one Twitch chat message became code execution on a streamer’s PC

67 points · 30 comments · tau255

  1. Scryptonite · · focus · HN ↗
    Deja Vu. I had to submit an issue and fix a similar issue years ago -- it was similarly Twitch chat overlay XSS, but for that they (the streamer) at least tried to strip the tags (but it was a poor JS implementation of PHP strip_tags), and the streamer didn't understand the issue until I crafted a image with onload/onerror to freeze/hang the chat overlay.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.