Yikes —

Google temporarily shuts down Android TV photo sharing after privacy bug

A user was apparently able to see hundreds of Google Photo accounts.

Google temporarily shuts down Android TV photo sharing after privacy bug
Google

Google has temporarily disabled Android TV photo sharing after reports of a brutal bug popped up on Twitter. Through the Google Home app, Android TV has a "linked accounts" feature that lets several people (like, say, you and your spouse) share photos from multiple Google Photos accounts to the TV. Apparently something went horribly wrong with this feature earlier, as pictures and videos show hundreds of accounts from strangers listed under "linked accounts."

Twitter user Prashanth posted two videos of the "Linked Accounts" feature going haywire. After the above video scrolling through linked accounts, a second shows him enabling random accounts. "Oh my god." Prashanth tweeted, "Private @googlephotos of strangers are being shown to me in the ambient mode screensaver. SERIOUSLY WHAT THE F--K?!" While the main profile photos of strangers were appearing under his account, Prashanth noted that the display of entire photo collections did not work.

Prashanth speculated earlier that the issue was a problem with his Vu TV, since his other Android TV device, a Xiaomi Mi Box 3, did not show random accounts. A Vu spokesperson spoke to Gadgets 360 and blamed the issue on Google, though. “We were recently notified that there was a malfunction of Google Home App in some of the Android TVs." the spokesperson told Gadgets 360. "After verifying the incident we have informed our customers that it was not an issue of Vu Television but it was software malfunction of the Google Home App. We take your privacy very seriously. Vu has a long-standing commitment to protecting the privacy of the personal information that our customers entrusts to us.”

The issue is clearly not happening to every Android TV device, just some subset of devices. Another user reported seeing a similar issue in a iFFalcon Android TV device. Prashanth noted that his device was running Android 7.0 Nougat and "hasn't got a security patch since 2017."

After a back and forth with the @madebygoogle account on Twitter, Google disabled photo sharing temporarily. In a statement to Ars and others, a Google spokesperson said, "We take our users’ privacy extremely seriously. While we investigate this bug, we have disabled the ability to remotely cast via the Google Assistant or view photos from Google Photos on Android TV devices."

Update: We updated this to clarify that Prashanth only saw stranger's profile pictures in the app, and couldn't cast whole photo collections to his TV.

Channel Ars Technica