# Auth Bypass in Google Assistant

A webpage could deeplink-trigger Google Assistant and play TTS audio commands aloud, executing Assistant actions like sharing location without permissions.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: David Schütz
- Disclosed: 2021-10-10
- Write-up quality: 7/10
- Original: https://feed.bugs.xdavidhu.me/bugs/0011
- Library page: https://bugbountylibrary.com/r/blog%3Afeed-bugs-xdavidhu-me-bugs-0011
- Tags: domain:mobile impact:integrity impact:internal-access kind:bounty platform:blog sev:high tech:android technique:chained technique:recon vuln:access-control vuln:auth-bypass

**Target:** Android Google Assistant / Chrome on Android
**Root cause:** Assistant accepted spoken commands from device audio without verifying the source, and a public deeplink allowed any webpage to auto-trigger Assistant listening mode.
**Steps:**
1. Generate TTS audio via Cloud TTS (en-US, en-US-Wavenet-A) for commands like 'share my location with' and 'send it'.
2. Host an HTML page with an anchor to `googleapp://deeplink/?data=...` that triggers Assistant.
3. On click, `setTimeout` 500ms then play short `share1.mp3`, then `share2.mp3` (phone number) after 6s, then `confirm.mp3` after 12s.
4. Keep audio short so Chrome doesn't treat it as media and Assistant doesn't pause it.
5. Assistant executes the spoken commands as the victim without any permission prompt.
**How found:** Researcher saw forum posts about using TTS audio to automate Assistant workflows via the 'Automate' app, realized it could be abused, and combined it with the public google.com deeplink that auto-triggers Assistant.
**Exploitation:** Victim visits attacker webpage; clicking a link fires the Assistant deeplink, then timed TTS audio plays commands aloud which Assistant interprets and executes (e.g., share location, send SMS, open smart-home door).
**Escalation:** Android apps could use the same VOICE_COMMAND intent without permissions, and play audio as an alarm to bypass mute/headphone limitations.
**Insight:** Voice assistants that accept device-played audio as commands can be hijacked by any app or webpage that can trigger the assistant and emit TTS; look for public deeplinks/intents that start listening without user gesture.