Archive — US — techcrunch
Google fixes bug that could reveal users’ private phone numbers
A researcher discovered a bug in Google's account recovery feature that could expose users' private phone numbers. Google confirmed the fix after being alerted in April. The exploit involved bypassing security measures, allowing attackers to reveal recovery numbers, potentially leading to security risks such as SIM swap attacks. Google thanked the researcher, offering a $5,000 reward for their findings.
Key points
- A security bug could reveal recovery phone numbers linked to Google accounts.
- The bug allowed an attacker to bypass Google’s anti-bot protection mechanisms and rate limits.
- The process involved leaking the display name and executing a script to brute-force the phone number.
- The bug could expose users to targeted security threats, such as SIM swap attacks.
- Google promptly fixed the bug after being notified and paid the researcher a $5,000 bounty.
Why it matters
- This incident highlights ongoing security challenges in tech, specifically concerning user privacy.
- Account recovery security is a focus in 2025 IT trends, as companies enhance safeguards against such exploits.
- Bugs leading to potential security risks have significant historical precedents, underscoring the importance of vulnerability reporting.
The discovery and subsequent fix of this bug illustrates the critical role of security researchers in protecting user data, emphasizing the necessity for robust security measures in tech development.