Google is working to fix an Android TV privacy issue that could allow people to access the emails of a person who is logged into a television.
As its name suggests, Android TV runs the Android operating system, so when a person logs into a television with a Google Account, Google remembers it and lets them log into other apps with that account too. Technically, this excludes more sensitive apps like Gmail and Drive because Chrome isn't allowed on Android TV. As 404Media reports, however, a YouTube user discovered a workaround that provided access to Gmail, Google Drive, and anything else tied to the account.
The hack is a bit complicated and involves downloading a third-party Android TV web browser called "TV Bro" and then finding the APK for Chrome and installing it on the TV.
Chrome doesn’t support TV remotes, so you’ll also need a keyboard and mouse connected to your TV for it to work. Still, if someone is eager enough to snoop on a Gmail account or poke around the Google Drive files of whoever signed into the TV, this is a relatively easy way to be a creep.
After being alerted to the workaround by Sen. Ron Wyden (D-Ore.), Google initially said the issue was expected behavior. But after it was contacted by 404 Media, Google said it would work on a fix for affected TVs, the outlet says.
"Most Google TV devices running the latest versions of software already do not allow this depicted behavior,” Google tells 404 Media. "We are in the process of rolling out a fix to the rest of devices."
Regardless, if you do log into an Android TV in a shared location, you may want to use a throwaway Google account to avoid potentially putting yourself in a similar situation in the future.