How Google fixed the account security loophole on Android TV | Technology

A loophole in Android TV OS left a backdoor open for users to access a TV owner’s Gmail inbox among other things, but Google is rolling out a fix, and the company has now confirmed what that fix is.

Android TV OS, like Android on your phone, signs into a Google account at the system level. This allows certain apps, like Google Chrome, to sign into that Google account without requiring a password. That’s by design and generally not a problem as smartphones and tablets typically have a PIN, password, or biometrics protecting the apps on your device.

That is not the case with Android TV and Google TV, though.

It was first pointed out earlier this year and then highlighted in a report this week that malicious actors could, in theory, sideload Google Chrome onto an Android TV OS device and then use that to access the Google account of the TV’s owner. It’s not so much a security exploit, but a loophole that’s not super difficult to pull off, as long as you know how to access an APK and sideload the app.

Google, in a statement to 404 Media, had already confirmed that a fix was rolling out to Google TV and Android TV to fix the problem, but hadn’t detailed what that fix was.

“Most Google TV devices running the latest versions of software…”