Long Version Where this gets nuanced is when third party plugins, alert providers, and custom browser sources come in. The news going around states "A chat message can hack your PC" which while true, is alarmist without the specifics. The first sequence of the chain requires that a chat message is injected into the webpage unsanitized. This is an amateur mistake but easy to make for anyone who is simply a hobbyist developer, or worse, a vibecoder. This flaw on it's own means something like a chat message containing code will be run on the page. On it's own, this can be abused to take full control of the alert or overlay with the issue. To be affected by it, it requires you to set up a browser source pointed at a malicious or compromised page with this mistake. The second sequence in this chain is a flaw in the version of Chromium that OBS uses to power the browser functionality. This flaw allows javascript to escape the page itself and run on your system. This is obviously very bad. Chromium itself fixed that particular bug awhile ago, but the version we ship with OBS has been stuck on a specific (and old) version. Chromium also has sandboxing, which is an additional layer of protection that would prevent this. For a variety of reasons, OBS has to disable the sandbox and updating CEF beyond that stuck version has been an incredibly complicated process that has taken over a year of work by some amazing volunteer contributors to the project like @WizardCM. If you are interested in the details of that: github.com/obsproject/obs-st… Fortunately for us, that work was already completed very recently and will be included in OBS 33.0 which is currently in beta testing as we speak. That fixes the second problem which IS more severe, but the first one will always be a potential problem and depends entirely on the creator of your alerts and widgets. Only ever use alerts, overlays, and plugins from authors that you trust, not only to be genuine but ALSO competent!