Android TV Security Bug Exposes Other Users’ Photo Albums, Google Shuts Feature Temporarily

Editor

posted on 5 years ago — updated on 1 second ago

56
views

According to a Vu Android TV user, the linked accounts feature in the Google Home app malfunctioned and started showing accounts from strangers.

The Android TV photo sharing feature has been temporarily shut down by Google after a report suggested a major security flaw. According to a Vu Android TV user, the linked accounts feature in the Google Home app malfunctioned and started showing accounts from strangers.

Prashanth went on Twitter and posted two videos clearly showing the bug. The first video shows him scrolling through multiple linked accounts while a second video shows him enabling random accounts. He tweeted that private Google Photos of strangers were being shown to him in the ambient mode screensaver. He later confirmed that while main profile photos of strangers were appearing under his account, the entire photo collections could not be displayed. Notably, his Vu Android TV was running Android 7.0 Nougat and "hasn't got a security patch since 2017."

He went on to confirm that the issue was only happening on his Vu Android TV since he didn’t notice any random account on his Xiaomi Mi Box 3, an Android TV box device. A report by Gadgets 360 says that Vu has officially given a statement blaming the issue on Google, “We were recently notified that there was a malfunction of Google Home App in some of the Android TVs. After verifying the incident we have informed our customers that it was not an issue of Vu Television but it was software malfunction of the Google Home App. We take your privacy very seriously. Vu has a long-standing commitment to protecting the privacy of the personal information that our customers entrusts to us.”

When I access my Vu Android TV through the @Google Home app, and check the linked accounts, it basically lists what I imagine is every single person who owns this television. This is shocking incompetence. pic.twitter.com/5DGwrArsco — prashanth (@wothadei) March 3, 2019

While this bug could be affecting only a certain set of Android TV units, there was another user who also confirmed about the issue on his iFFalcon Android TV, which an in-house brand from e-commerce retailer Flipkart.

Taking matters seriously and after discussing the issue, Google has disabled the photo sharing temporarily for Android TV. A Google spokesperson said, "We take our users’ privacy extremely seriously. While we investigate this bug, we have disabled the ability to remotely cast via the Google Assistant or view photos from Google Photos on Android TV devices."

Have you faced a similar issue with your Android TV?