How one Twitch chat message became code execution on a streamer’s PC

A Twitch streamer's PC was compromised by a malicious chat message that executed code, highlighting a vulnerability in the platform's chat system. The incident involved the use of a technique called 'DOM-based XSS' (Cross-Site Scripting) to inject malicious code into the streamer's browser. This was achieved by manipulating the chat message's HTML to execute JavaScript code in the browser's context. The streamer's browser was running in a vulnerable mode that allowed the code to be executed with elevated privileges, allowing the attacker to access sensitive information and potentially take control of the streamer's account.