Critical RCE Found in Teleparty Chrome Extension

Executive Summary

Security researchers using Dymo discovered a critical Remote Code Execution (RCE) vulnerability in the Teleparty browser extension (formerly Netflix Party). This vulnerability allows malicious actors to take control of users' browser tabs and execute arbitrary code with the extension's privileges.

Technical Details

Affected Extension

• Name: Teleparty (Chrome/Edge)
• Functionality: Browser tab synchronization for streaming
• Permissions: High - tabs, storage, network access

Vulnerability Classification

• Severity: Critical
• CVSS Score: 9.6 (Critical)
• Type: Remote Code Execution via Extension

Attack Mechanism

The vulnerability exists due to insufficient input validation in the extension's communication layer:

1. Tab Takeover: Attackers can inject scripts into active tabs
2. Session Hijacking: Access to session cookies and local storage
3. Code Injection: Arbitrary JavaScript execution in victim context
4. Data Exfiltration: Steal passwords, tokens, and sensitive data

Security Implications

Browser extensions operate with significant privileges:

• Full Page Access: Can read/modify all page content
• Storage Access: Read/write extension storage
• Network Requests: Make requests on behalf of the user
• Clipboard Access: Read clipboard contents

Recommended Mitigations

For users:

1. Disable Teleparty extension until patched
2. Review active sessions and revoke suspicious access
3. Enable extension permissions alerts

For developers:

1. Implement strict message validation
2. Use Content Security Policy in extension context
3. Add runtime permission checks

Conclusion

Browser extensions represent an often-overlooked attack surface. This finding underscores the importance of reviewing third-party code with the same scrutiny applied to primary applications.

This vulnerability was discovered through automated scanning with Dymo.