A Bugcrowd disclosure by researcher JayTaelien (disclosed Oct 14; program not named on the page; rated P1, $5,500, status 'accepted and fixed') describes a one-click chain against the Discord desktop app. An attacker page shows up as a Twitch rich embed. A gap in how Twitch's player parses force_manifest_node lets an inline HLS playlist load an attacker-chosen ad-verification (OMID) script, which gives JavaScript execution. From a Discord popout that inherits that origin, the chain uses a V8 RegExp use-after-free to get memory read/write and native code execution. It then abuses Discord's Electron IPC (file-dialog, clip-file and updater calls, plus Windows WebClient) in a race to take control of the updater executable and run cmd.exe. The victim only has to click the embed. There is no report of exploitation in the wild. Discord's desktop client updates itself, so the main action is to make sure clients have restarted onto current builds.