Chrome Web StoreDo not install
Code review: high
Our reviewer read this extension’s code and confirmed malicious behaviour. 4 security findings documented below. Do not install it. Remove it if you already have it.
3 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Netflix Party, used by 400,000 people, is rated malicious by Extension Auditor. Our code review reported 4 findings (3 high, 1 medium), led by other. Its permissions mean it can read and change data on all websites and can inject scripts into pages.
Key findings
- High
Other
The extension fetches remotely supplied rules that match arbitrary URLs. When a rule matches, it posts a signal and then fetches server-provided URLs with cache:no-store and no further processing. This is unrelated to the watch-party feature and can be used for affiliate cookie-stuffing, pixel firing, or ad fraud without user knowledge.
- High
Tracking
Every completed page load is checked against backend-driven rules. If a match exists, runPartyRule sends partySignalHit to the backend, disclosing to the server that the user visited a URL containing server-defined strings. This browsing-activity tracking is tied to a generated uid and is not declared in the CWS data collection disclosures.
- High
Other
The published Chrome Web Store manifest summary lists permissions as only ['tabs','storage'] and does not show 'scripting'. The bundled manifest adds the 'scripting' permission, which allows injection of JavaScript into arbitrary sites. This mismatch is itself a security finding.
- Medium
Unauthorized Data Collection
The currently playing media title and alternative title candidates extracted from the page are sent to the backend endpoint The CWS listing declares zero data collection, so this collection of viewing activity is unauthorized and undisclosed.
Analyst notes
The background service worker fetches remote rules from [domain withheld] and then, on every page load, matches a URL against those rules and triggers server-controlled fetches to arbitrary URLs via This is unrelated to the watch-party UI, sends an undisclosed browsing signal (partySignalHit) tied to a persistent uid, and enables or ad-fraud. The ML critical score and chrome-stats elevated risk are corroborated by this concrete code behavior; the published manifest also omits the 'scripting' permission present in the bundled manifest.
Netflix Party Chrome extension security report
ID: mmnbenehknklpbendgmgngeaignppnbe
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Baker&Co
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Screenshots & videos
Install growth
- 3 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
3 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Install Netflix Party Plus Chrome extension to watch along with your friends
Read the publisher’s full description
How to Start Netflix Party >>Install Netflix Party chrome extension. >>Open any Netflix video >>Click on the extension icon and Start the Party >>Share the Party link with your friends and ask them to join >>Now watch along with your friends or family Netflix Party Features >>Sync: Click on sync button to match your video timings with all the other party members >>Live Tracking: Get to know the real time video duration of every person in the party >>Profile & Chat: Change your name and avatar to chat with your friends all the time. Update: Now supports the watch party with video chat for prime video, Youtube and Jiocinema.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
3 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Just for Fun
- Custom Cursor for Chrome™6,000,000 users
- Return YouTube Dislike5,000,000 users
- Stylish - Custom themes for any website2,000,000 users
- FrankerFaceZ1,000,000 users
- Shimeji Browser Extension1,000,000 users