Bug in Google Home App Exposes Private Photos

A bug in Google Home app allows user to access Google Photos from unknown Google users. This is a massive breach of privacy.

Yesterday a movie reviewer from Chennai posted on twitter that he was seeing random accounts in the “Linked Accounts” setting of Google Home App while connecting to his Android TV.

He tweeted:

When I access my Vu Android TV through the @Google
Home app, and check the linked accounts, it basically lists what I imagine is every single person who owns this television. This is shocking incompetence.
https://twitter.com/wothadei/status/1102089147596992512

When I access my Vu Android TV through the @Google Home app, and check the linked accounts, it basically lists what I imagine is every single person who owns this television. This is shocking incompetence. pic.twitter.com/5DGwrArsco
— prashanth (@wothadei) March 3, 2019

Mr. Prashant’s first tweet

However when he tried to add screensaver from “Google Photos” in the “Ambient mode” he was presented with the same list of linked accounts. He randomly selected an account.

Voila!, private pictures from Google Photos of that account were displayed on his Android TV. At this point Mr. Prashant tagged Google and Google India to address the issue.

Oh my god. Private @googlephotos
of strangers are being shown to me in the ambient mode screensaver. SERIOUSLY WHAT THE FUCK?! @Google
@GoogleIndia
https://twitter.com/wothadei/status/1102090934739595264

Oh my god. Private @googlephotos of strangers are being shown to me in the ambient mode screensaver.

SERIOUSLY WHAT THE FUCK?! @Google @GoogleIndia pic.twitter.com/VbMmb3B2Qp
— prashanth (@wothadei) March 3, 2019

Mr. Prashant’s discovery and report to Google

Google after asking basic security questions didn’t acknowledge that the bug resides in Google Accounts authentication mechanism and directed Mr. Prashant to contact the TV manufacturer.

We understand — we value our user's privacy and we suggest contacting your TV's manufacturer to check for firmware updates and help in resetting your device properly. About your Google Photos, are you casting from the app or using Ambient Mode?
— Made by Google (@madebygoogle) March 3, 2019

Google’s response

However some other users have confirmed that the same issue can be reproduced on Android TVs by different manufacturers.

This is clearly a google accounts issue and NOT an problem with TV manufacturer.

Here able see the same with another manufacturer's TV as well: pic.twitter.com/Jr3SDG5RkV
— Aarjith Nandakumar (@aarjithn) March 3, 2019

Mr. Arijath provide a reproduction of bug

This is a massive breach of privacy of Google Photos users and as of this time Google has not yet acknowledged it.

We have not received any reply from Google at the time of publication.