Android TV bug may have allowed access to other users’ private Google Photos, functionality now disabled

Ben Schoon | Mar 4 2019 - 8:08 am PT

One nice perk of Android TV as a platform is that it allows users to display their Google Photos albums on a screensaver when the TV is idle, just like Chromecast. However, an Android TV bug discovered this week allowed one user access to the private photo libraries of many other users. Yikes.

Spotted first by a Twitter user (via XDA-Developers), a strange bug within the Google Home app allowed that user access to the private Google Photos of many other accounts. It’s unclear how many accounts are affected by this or what exactly triggers the bug, but the “linked accounts” list shows a huge list of accounts that aren’t directly associated with that model TV.

What’s especially shocking, though, is that this bug grants the user access, albeit limited, to those users’ Google Photos albums. This doesn’t give direct access to the entire Photos library, but it ~~does allow those photos to be used as backgrounds for the Android TV screensaver~~. This issue is pointed out by the same Twitter user.

Update: The functionality which would have shown another user’s private Google Photos as a backdrop apparently didn’t actually work. It’s unclear if that was just the case for this user, but the accounts being showed still raise some red flags and begs the question of if some users were successfully able to see photos from other accounts.

So far, Google doesn’t seem to know the cause of this problem. In a statement, the company says that they take privacy “extremely seriously.” Further, as a precautionary measure, Google has disabled the ability to view photos from Google Photos on Android TV devices or cast remotely via Assistant.

We take our users’ privacy extremely seriously. While we investigate this bug, we have disabled the ability to remotely cast via the Google Assistant or view photos from Google Photos on Android TV devices.