Privacy leak found in Google Home and Chromecast that would let a malicious site find a user's precise location from Wi-Fi info; Google to fix leak within weeks
Brian Krebs / Krebs on Security :
Context & Ripple Effects
This lands five months after the Google Cast protocol bug that knocked routers offline, which had already put the Cast stack under scrutiny, and days before researchers demonstrated [[a:930807|DNS rebinding attacks that reach devices like Google Home, RokuTV, and Sonos speakers from the browser]]. Together they sketch a pattern: always-on living-room devices reachable from any web page a user visits.
The stakes here are higher than uptime — this leak converts Wi-Fi information into a precise physical location, disclosed to whichever site asks. Krebs' report also predates the broader vetting failures later documented across voice platforms, where researchers showed malicious Alexa and Google Home apps eavesdropping on users while Amazon and Google took a lax approach to review.
First-order effects
- Any user who visits a malicious site while a Google Home or Chromecast sits on their network can have their precise location read from Wi-Fi data until Google ships the promised fix within weeks.
Second-order effects
- The finding pressures Google's device security process alongside the Cast outage earlier in 2018, and gives router vendors and rival smart-speaker makers ammunition to differentiate on local-network hardening rather than features.
Third-order effects
- If the pattern holds — browser-reachable IoT devices leaking location, later echoed by camera-app bugs that extracted GPS data — consumer IoT shifts toward treated-as-web-endpoint security, with mandatory patch cadence and platform vetting becoming table stakes; Google's own internal tracking of thousands of privacy and security issues from 2013–2018 suggests the company was accumulating exactly this class of debt.
The trend: Consumer smart-home devices are becoming a browser-reachable attack surface for location and eavesdropping, with vendor patch speed and app vetting emerging as the decisive controls.