Without a zero day in the actual decoder (which is probably a possibility given the resources they poured into this), one way would be to send someone a playlis

Without a zero day in the actual decoder (which is probably a possibility given the resources they poured into this), one way would be to send someone a playlist file that tells the player to fetch the video from some URL. Does the player on Tails obey proxy settings when playing URLs from an m3u? Maybe it was that easy or maybe they had to abuse something like fragmented nature of Linux media playback to find a neglected component that carelessly makes network connections, or find a way to call youtube-dl which is often integrated with these players.