Today, Google has shut down Google Photos sharing on Android TV devices. It has been discovered that there was a bug. The said bug has disclosed hundreds of user accounts to the other users.
The owners of the Android TV will not be able to set Google Photo albums as their screensavers or even view pictures with the Google Assistant on their smart TVs or set-top devices. Unless the bug is resolved access to these apps are not allowed.
Twitter user Prashanth first spotted the bug. Prashanth noticed that while trying to set up a screensaver, on a Vu brand TV, they were able to view hundreds of other Google accounts. The bug that has also been replicated by user Aarjith Nandakumar found on his iFFalcon smart TV, according to The Verge.
Thus, it is not yet clear on what caused the bug. Prashanth noted that they could not replicate the bug on another Android TV device. Of which is a Xiaomi Mi Box 3. Hence, Google has temporarily blocked the feature on the company's end. Because it is quite difficult to see how widespread the problem would be.
When I access my Vu Android TV through the @Google Home app, and check the linked accounts, it basically lists what I imagine is every single person who owns this television. This is shocking incompetence. pic.twitter.com/5DGwrArsco — prashanth (@wothadei) March 3, 2019
According to Android Police, Prashanth was kind enough to share more of the details with regards to the incident. He said that when he signed into the TV using his wife's Google account to be greeted with the same list, except this time he could see his own name and profile picture in it.
As follows, it should be noted that the brand Vu TV can also be questioned as it still runs on Android 7.0. it does not have any security updates since December of 2017, even though he is checking it manually for updates. However, the literature on Flipkart, which is the site where he bought the TV, did mention that it is being operated by Android 8.0 Oreo.Thus, it is more likely that the update did not push through his Android TV.
Meanwhile, the bug did not give access to the entire photo collection from the user's accounts. It only showed their profile picture and account name. But it is still accepted as a severe security hole.
In a statement that has been released to Android Police, Google said that "We take our users' privacy extremely seriously. While we investigate this bug, we have disabled the ability to remotely cast via the Google Assistant or view photos from Google Photos on Android TV devices."
On the other hand, in a separate statement, Vu claimed that the fault was not an issue of Vu Television. "But it was software malfunction of the Google Home App." Thus, Google is already aware and give necessary measures to fix the bug.
