An embarrassing privacy issue involving Google's Android TV platform has been discovered by a user, who has shared his experience on Twitter. The issue appears to show strangers' Google accounts linked to the Google Home app, as well as give access to strangers' Google Photo albums. The issue was first spotted on a Vu Android TV, but was also seen by another user on iFFalcon Android TV. The Vu Android TV user has shared short videos detailing the issue on his Twitter profile. As reported by the user, the bug appears to show linked accounts of thousands of Android TV users on the Google Home app, allowing him to access the private information and photos of thousands of unsuspecting users. Both Vu and Google have responded to queries from Gadgets 360, detailing the issue.
Twitter user @wothadei shared two tweets that showed the issue. While accessing the device settings for his Vu Android TV through the Google Home app, the user found that thousands of accounts were linked to the TV, which were obviously not his own. He further explained that he could set up the ambient mode to show photos from Google Photos of multiple other linked users. This would give access to the private photos of all users to anyone that has these accounts linked, which is a massive privacy violation. Another user has also reported a similar issue with an iFFalcon Android TV, suggesting that the issue is likely on the Android TV platform rather than being caused by a specific manufacturer.
When I access my Vu Android TV through the @Google Home app, and check the linked accounts, it basically lists what I imagine is every single person who owns this television. This is shocking incompetence. pic.twitter.com/5DGwrArsco— prashanth (@wothadei) March 3, 2019
Many Android TV devices, including the Vu Android TV range, come with built-in Chromecast, allowing users to ‘cast' content from their smartphones, tablets or computers to the TV wirelessly. The Chromecast requires to be set up, configured and connected to the Wi-Fi using the Google Home app, and can be done using a smartphone, and you can also link other accounts that would have the ability to control the device. In this case, the bug in question has linked multiple accounts to the Google Home app of the user, allowing access to private data including personal information and photos. Both Vu and Google have responded to the issue.
“We were recently notified that there was a malfunction of Google Home App in some of the Android TVs. After verifying the incident we have informed our customers that it was not an issue of Vu Television but it was software malfunction of the Google Home App.We take your privacy very seriously. Vu has a long- standing commitment to protecting the privacy of the personal information that our customers entrusts to us.” said a Vu spokesperson in a statement to Gadgets 360.
A Google spokesperson has also issued a statement to Gadgets 360 on the matter, “We take our users' privacy extremely seriously. While we investigate this bug, we have disabled the ability to remotely cast via the Google Assistant or view photos from Google Photos on Android TV devices.”
This is not a Vu TV only issue. Have noticed the same in iFFalcon android TV via Google Home app. pic.twitter.com/G4qJttLzVy— Aarjith Nandakumar (@aarjithn) March 3, 2019
It's currently unclear what has caused this bug, but it is a rather serious breach of privacy that has affected Android TV users, and perhaps anyone with a Google account linked to a smart TV or streaming device in general. We will be following this issue and continue to update you on any new developments.