Researcher Found Flaw to Discover Phone Numbers Linked to Any Google Account

Google has patched a security vulnerability that allowed attackers to potentially brute-force Google account recovery phone numbers via a deprecated username recovery form, which lacked sufficient anti-abuse protections. A security researcher, 'brutecat,' demonstrated how an attacker could leverage this flaw, in conjunction with other techniques like exploiting Looker Studio and the 'Forgot Password' flow, to reveal a user's phone number and subsequently take control of associated accounts through SIM swapping. Google has since removed the vulnerable form and awarded the researcher a $5,000 bug bounty; this follows prior disclosures by the same researcher regarding YouTube API exploits that could expose email addresses of channel owners.

Analysis

Alphabet Inc.'s Google (GOOGL) has successfully addressed a security vulnerability within its account recovery framework that could have allowed attackers to brute-force a user's recovery phone number. The flaw, identified by security researcher 'brutecat,' resided in a deprecated, non-JavaScript version of Google's username recovery form which lacked sufficient anti-abuse protections like CAPTCHA-based rate limiting. Exploitation involved a multi-step process: leaking the Google account display name (e.g., via Looker Studio), obtaining a masked phone number with the last two digits from the 'Forgot Password' flow, and then brute-forcing the remaining digits against the vulnerable recovery endpoint. This technique could reportedly reveal a Singapore-based number in approximately 5 seconds and a U.S. number in about 20 minutes, creating a pathway for SIM-swapping attacks and subsequent account takeovers. Google remediated this specific issue by completely removing the non-JavaScript username recovery form as of June 6, 2025, following responsible disclosure on April 14, 2025, and awarded the researcher a $5,000 bug bounty. This incident, while now resolved, is part of a series of vulnerabilities discovered by the same researcher, including two prior YouTube API exploits (resulting in $10,000 and $20,000 bounties) that could expose email addresses of channel owners and YouTube Partner Program members. The market's reaction to this latest disclosure appears muted, with a neutral overall sentiment score (0.1), a low market impact score (0.2), and a slightly negative sentiment for GOOGL (-0.1), suggesting it's viewed as an operational cybersecurity event rather than a significant material risk. The pattern of discoveries, however, underscores the persistent cybersecurity challenges faced by large technology platforms and the utility of bug bounty programs.

Key Decisions for Investors

• Investors should view this specific patched vulnerability as a routine operational matter for Google, with the $5,000 bounty indicating a relatively low direct financial impact, consistent with the minimal market reaction observed.
• Consider the recurring nature of security disclosures from this particular researcher as an indicator of ongoing, intensive scrutiny of Google's platforms, which, while highlighting vulnerabilities, also demonstrates the functionality of Google's bug bounty system in identifying and addressing them.
• Monitor Google's broader cybersecurity posture and any future patterns of similar disclosures, as an accumulation of such incidents, even if individually minor, could potentially influence long-term operational costs related to security reinforcement or impact user trust.