# Stealing Your Private YouTube Videos, One Frame at a Time

IDOR in Google Ads VideoMomentService/GetThumbnails let any advertiser fetch thumbnail frames of arbitrary private YouTube videos by video ID.

- Payout: $5,000
- Severity: high
- Program: Google
- Credited: David Schütz
- Disclosed: 2021-01-11
- Write-up quality: 7/10
- Original: https://bugs.xdavidhu.me/google/2021/01/11/stealing-your-private-videos-one-frame-at-a-time/
- Library page: https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-11-stealing-your-private-videos-one-frame-at-a-time
- Tags: domain:web impact:data-leak impact:integrity kind:bounty platform:blog sev:high tech:rest technique:recon vuln:access-control vuln:idor

**Target:** Google Ads VideoMomentService GetThumbnails RPC endpoint
**Root cause:** The Ads Moments thumbnail endpoint fetched frames by video ID without verifying the caller had access to the video, unlike main YouTube endpoints.
**Steps:**
1. Create Google Ads account and a video ad using own video.
2. Open Videos > video > Analytics > Moments.
3. Mark a moment and capture `POST /aw_video/_/rpc/VideoMomentService/GetThumbnails` with `__ar={"1":"<videoId>","2":"<ms>","3":"<id>"}`.
4. Replace field 1 with a private video ID owned by another account.
5. Response returns base64-encoded JPEG thumbnail of that private video.
6. Iterate field 2 in 33ms increments (24 FPS) to reconstruct frames into a GIF/video.
**How found:** Hypothesized that a secondary product (Google Ads) interacting with YouTube resources internally might lack the privacy checks of main YouTube; enumerated Ads features, found Moments thumbnail RPC, and swapped the video ID.
**Exploitation:** Attacker with any Ads account and knowledge of a private video ID requests thumbnails at successive millisecond offsets, decoding base64 frames to reconstruct low-res silent video content.
**Insight:** Cross-product integrations (ads, embeds, analytics) often re-implement resource access without the primary product's authorization checks; enumerate secondary surfaces that reference the same object IDs.