Android TV bug gives access to strangers’ Google Photos accounts

Google has disabled Android TV’s ability to view Google Photos uploads as a screensaver, after a user discovered it was dishing out access to other people’s photos.

Via the Google Home app, Twitter user ‘pransanth’ showcased the ability to access a giant scrolling list of Google Photos accounts. After selecting a random name from the list, that person’s private Google Photos uploads were being displayed to him in the Ambient Mode screensaver.

The user believed the account may have offered access to the accounts of every other person who owned the same Vu Android TV television set, but that’s yet to be consumed. Google has admitted the quite spectacular security bug and is taking the feature offline while investigating the problem.

“We take our users’ privacy extremely seriously,” a Google spokesperson said in a statement. “While we investigate this bug, we have disabled the ability to remotely cast via the Google Assistant or view photos from Google Photos on Android TV devices.”

It’s currently unclear how many users the bug is currently affecting, bit it’s highly unlikely this is an isolated incident. It’s also unclear whether other Android TV devices are affected by the bug. The TV in question runs on Android 7 and hasn’t received a security update since 2017. As XDA developers reports, another Twitter user said he was able to access the bug using a television from a different, unnamed manufacturer.

Is Google doing enough to safeguard the privacy of users? Do you trust the company to take care of your accounts and personal data? Let us know @TrustedReviews on Twitter.