# Auth Bypass in com.google.android.googlequicksearchbox

Google Assistant on Android served personal results to paired Bluetooth headphones on the lock screen by default, bypassing the user's disabled 'On headphones' privacy setting.

- Payout: $1,337
- Severity: medium
- Program: Google
- Credited: David Schütz
- Disclosed: 2022-02-06
- Write-up quality: 6/10
- Original: https://feed.bugs.xdavidhu.me/bugs/0013
- Library page: https://bugbountylibrary.com/r/blog%3Afeed-bugs-xdavidhu-me-bugs-0013
- Tags: domain:mobile impact:data-leak impact:pii-leak kind:bounty platform:blog sev:medium tech:android technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Google Android app (googlequicksearchbox) Assistant personalization settings
**Root cause:** Bluetooth headphones were governed by a separate default-enabled 'Allow Bluetooth requests with device locked' toggle instead of the 'On headphones' personal-results setting, so disabling the latter did not stop personal queries over Bluetooth.
**Steps:**
1. Pair a Bluetooth headset to a locked Android device with the Google app.
2. In Google app > Settings > Assistant > Personalization, disable 'Lock screen personal results', 'Personal suggestions on lock screen', and 'On headphones'.
3. With the phone locked, invoke Assistant via the paired BT headset and ask a personal query such as `what restaurants have I visited`.
4. Observe personal results are returned despite the disabled setting; the controlling toggle is Google app > Settings > Voice > 'Allow Bluetooth requests with device locked', enabled by default.
**How found:** Researcher audited the consolidated Personalization settings page, noticed 'On headphones' did not cover normal Bluetooth devices, and confirmed via two devices plus a fresh app reinstall that the separate Bluetooth toggle defaults to enabled.
**Exploitation:** Attacker with brief physical access to a locked phone and its already-paired Bluetooth headset (commonly stored together) speaks a personal query through the headset and receives personal results without unlock credentials.
**Insight:** When a vendor consolidates privacy toggles into one settings page, test each toggle against every transport (wired, BT, Pixel Buds) to find controls that silently don't govern the path they claim to; default-on legacy toggles on a different page are the tell.