Google is updating Android TVs to fix a big Gmail privacy problem

/

Some Android TVs could expose the owner’s emails to any nosy people in the living room.

By Umar Shakir, a news writer fond of the electric vehicle lifestyle and things that plug in via USB-C. He spent over 15 years in IT support before joining The Verge.

Share this story

If you buy something from a Verge link, Vox Media may earn a commission. See our ethics statement.

The Android logo on a black backdrop, surrounded by red shapes that resemble the Android mascot.

Illustration: Alex Castro / The Verge

Google is working on a fix to block crafty individuals from gaining access to the emails of accounts logged in to some Android TV units. The Android TV operating system, which is preloaded on many smart TVs on the market, could allow people with physical access to get into Gmail and other services associated with the owner’s account, as reported by 404 Media.

Since Android TV is just Android under the hood, it treats the owner’s Google account login as a persistent one, allowing them to automatically log in to allowed apps from the Play Store. Chrome is not allowed by Google to install on Android TV, but there’s a workaround that could get it installed, allowing easy access to Gmail, Drive, and other services — as demonstrated by YouTuber Cameron Gray.

In the video, Gray downloads “TV Bro,” a third-party Android TV web browser that’s available on the Play Store. Using the browser, Gray finds an APK for the Chrome browser from an online archive and installs it with no issue — although the app doesn’t support TV remotes, so a keyboard and mouse need to be used at this point. But once Chrome is open, all that’s left is to head over to gmail.com, and you’re in.

As 404 Media reported, the video was shared with Google by the office of Senator Ron Wyden, and the company told them it was expected behavior and not a security issue. After mounting pressure, however, Google now vows to fix the loophole.

“Most Google TV devices running the latest versions of software already do not allow this depicted behavior,” a Google spokesperson told 404 Media. “We are in the process of rolling out a fix to the rest of devices.” Google also reminds users to keep software up to date.

Users who feel their privacy could be at risk in their environment could consider using a different Google account to log in to Android TV sets. The separate account could be designated as a “family” one and can be added as a Google Family member so the TV can still have access to YouTube TV and other services. Plus, you can rest easy that your viewing history won’t get borked by loved ones.

Go to Source