An Android TV bug has now surfaced which seems to provide owners of an affected device with access to the account names of other people with the same device, as well as the option to link the Google Photos accounts of those other people.
It currently remains unclear how widespread the issue is with the initial reports seemingly tied to India. Likewise, only Android TV devices manufactured by Vu and iFFalcon have been so far confirmed to be vulnerable. Therefore, at present there’s nothing to suggest Android TV device owners outside of the region or using devices by other brands need to be immediately concerned with the issue.
The bug seems to be technically more of a Google Home app bug than anything else as that’s where the information is leaking from. One of the users who first noted the issue on social media has shared a couple of videos demonstrating the issue. What happens is when the user logs into the Google Home app and goes to the settings for one of the affected devices, the “linked account” section seems to detail a long list of Google account names. Presumably, a list of people who also own the same device.
Usually this section only provides details about the accounts that have been manually linked to the device along with the option to manually add other accounts.
One of the videos also shows the list is present in the Google Photos section of the Home app as well, along with how the user is able to select people from that list and toggle them on - as if to instruct the Google Home app to display their photos from their Google Photos account on the Android TV device.
Again this is a feature commonly available on Android TV which lets users display their own Google Photos uploaded images when the screensaver on Android TV is in effect. This particular aspect of the bug is likely to be the most concerning to Android TV device owners although the user has since confirmed that photos belonging to other accounts are not actually showing up on the Android TV device - just the option within the Google Home app is.
Google does seem to already be aware of the issue and did reply to the original poster message via the company’s “Made by Google” account, stating Google is looking into the issue.
The tweet also states Google is “disabling Google Photos for Android TV and the ability to remotely cast via the Google Assistant” in the meantime. Again, it is currently unclear if this precautionary measure is widespread or just resigned to the area the bug has been noted in, or only on the devices so far understood to be vulnerable to the issue.
For those who are concerned they might be affected by the issue, one solution seems to be to reset the Android TV device in question. By doing this the device will need to be re-added to the Google Home app and linked again to a primary Google account.