A security vulnerability discovered in YouTube could have potentially exposed email addresses of users through a flaw in the platform’s live chat system and Google Pixel Recorder functionality. The issue, identified by security researchers Brutecat and Nathan, was present from September 2024 to February 2025. The discovery comes at a time when Google has been actively strengthening its authentication systems across its platforms.
The vulnerability exploited YouTube’s user blocking mechanism, which stores obfuscated Google account IDs (Gaia IDs) instead of email addresses. When users accessed profiles in YouTube live chat, the system generated backend requests containing base64-encoded Gaia IDs, which could then be converted to reveal associated email addresses. The security gap raised particular concerns given Google’s recent push toward enhanced authentication methods and passkey support across its services.
The security flaw affected YouTube’s entire user base, presenting particular concerns for content creators who rely on anonymity. The vulnerability emerged despite Google’s participation in the cross-platform FIDO authentication initiative alongside Apple and Microsoft, which aims to strengthen user privacy and security across digital platforms.
Following the discovery, Google implemented a patch to address the vulnerability and awarded the researchers a $10,633 bug bounty. The company has verified that the security issue has been resolved, protecting users’ email addresses from potential exposure through this method. The response matches Google’s broader efforts to enhance security across its ecosystem, including recent implementations of Identity Check for Android devices and improved biometric authentication measures.
Security researchers noted that the exploit was “relatively simple to execute,” highlighting the need for continuous security monitoring across Google’s integrated services and platforms. The incident underscores the importance of robust security measures, particularly as federal agencies have been warning about vulnerabilities in various authentication methods.
Sources: Android Authority, Tech.co, TechRadar, SecurityWeek
Follow Us