Security hole allowed profile pictures and names to be viewed
Google has temporarily disabled the ability to share Google Photos to Android TV, after a bug was found to reveal information related to hundreds of accounts.
The shutdown means that, for now, those with a smart TV running on Google’s software won’t be able to set their Google Photos as a screensaver or look at them through the Google Assistant.
Read this: Tips, tricks and secrets to get started with Android TV
First spotted by a Twitter user with a Vu TV, the apparent breach seems to allow those checking the ‘Linked Accounts’ section of their TV in the Google Home app to also see everybody who has synced up to the same model. The same issue was then also replicated on iFFalcon TVs by another Twitter user, though wasn’t found on another Android TV device, the Xiaomi Mi Box 3.
When I access my Vu Android TV through the @Google Home app, and check the linked accounts, it basically lists what I imagine is every single person who owns this television. This is shocking incompetence. pic.twitter.com/5DGwrArsco
— prashanth (@wothadei) March 3, 2019
So, as of yet, it’s not clear how widespread the bug is across the Android TV family, or even what caused the profile pictures, account names and information to become available. Thankfully for those affected, their wider photos couldn’t be viewed through the oversight. However, Google has still responded by disabling the feature until the issue is resolved.
Guide: What is Google TV
In a statement given to Android Police, Google said: “We take our users’ privacy extremely seriously. While we investigate this bug, we have disabled the ability to remotely cast via the Google Assistant or view photos from Google Photos on Android TV devices.”
The company didn’t give an indication of when the feature would return to the platform, though it’s fair to estimate that it won’t be too long before this security flaw is patched up. Fortunately, on this occasion, it’s a breach that doesn’t appear to be too major or widespread.
