Thursday, May 22, 2025
HomeCVE/vulnerabilityGoogle Photos Vulnerability Allows Hackers To Track Location History

Google Photos Vulnerability Allows Hackers To Track Location History

Published on

SIEM as a Service

Follow Us on Google News

A vulnerability exists with the web version of Google photos allows malicious websites to extract the photos metadata information.

Google photos will tag your photos automatically based on the metadata information such as geographic coordinates, date, etc.

The Photo metadata allows information to be traveled along with the image file that can be read by software, hardware, and end users.

- Advertisement - Google News

Imperva security researcher Ron Masas discovered a browser side-channel attack. Researchers used an HTML link tag to create multiple cross-origin requests to the Google Photos search using javascript to measure the time it took for the onload event to trigger.

By calculating the baseline time based on the trigger event, then researchers used the search query “photos of me from Iceland” and compared the result to the baseline.

If the query took a long time than the baseline time, then it will be assumed that query returned results matching to the photos in Iceland.

How the Attack Works

In order to make the attack works, first, the attacker needs to trick the user to open the malicious website at the time when the user logged into Google Photos. Imperva published a Video demonstration explaining the attack.

Once the malicious website is opened in the browser it silently generates requests to the Google Photos search endpoint and extracts answers to any query the attacker wants.

This process can be incremental, as the attacker can keep track of what has already been asked and continue from there the next time you visit one of his malicious websites, reads Imperva report.

The vulnerability was reported to Google by Imperva and the vulnerability has been patched now.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Beware !! Hackers Exploiting WinRAR Vulnerability to Hack Windows Computer While User Extract the Content

APT Hackers Group Exploiting the Window OS Using New Zero-day Vulnerability

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

ThreatBook Recognized as a Notable Vendor in Global Network Analysis and Visibility (NAV) Report

ThreatBook, a global leader cyber threat and response solutions backed by threat intelligence and...

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party...

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs...

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party...

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs...

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate...