Researcher Found Flaw to Discover Phone Numbers Linked to Any Google Account
Google has stepped in to address a security flaw that could have made it possible to brute-force an account’s recovery phone number, potentially exposing them to privacy and security risks.
The issue, according to Singaporean security researcher “brutecat,” leverages an issue in the company’s account recovery feature.
That said, exploiting the vulnerability hinges on several moving parts, specifically targeting a now-deprecated JavaScript-disabled version of the Google username recovery form (“accounts.google[.]com/signin/usernamerecovery”) that lacked anti-abuse protections designed to prevent spammy requests.
The page in question is designed to help users check if a recovery email or phone number is associated with a specific display name (e.g., “John Smith”).
To read the complete article see: