Researchers uncover critical security vulnerability in YouTube and Google platforms

Google has fixed a security flaw that exposed the email addresses of YouTube users, a potentially massive privacy breach.

Google — which owns YouTube — has confirmed that the vulnerabilities discovered by cybersecurity researchers, who go by Brutecat and Nathan, have been addressed, according to a report in BleepingComputer.

Aside from the breach of privacy that would've affected all YouTube accounts, many YouTubers like controversial content creators, investigators, whistleblowers, and activists keep their identities anonymous to protect their safety. Exposing such users' emails could have had huge ramifications.

Brutecat discovered that blocking a user on YouTube revealed a unique internal identifier Google uses for each user across all of its platforms (Gmail, Google Drive, etc.) called a Gaia ID. They then figured out that simply clicking the three dot icon of a user's live chat profile to access the block function triggered an API request that revealed their Gaia ID.

This in itself is already a security flaw since it exposed the unique identifiers for YouTube accounts that is only meant to be used internally. But now that Brutecat was able to retrieve users' Gaia IDs, they set out to see if they could reveal the email addresses associated with each ID.

With Nathan's help, the two researchers surmised they could do this with "old forgotten Google products since they probably contained some bug or logic flaw to resolve a Gaia ID to an email." Using Google's Recorder app for Pixel devices, they tested sharing a recording with an obfuscated Gaia ID and blocked the user from receiving an email notification by renaming the file with a 2.5 million letter name, which broke the email notification system because it was too long.

Now that the hypothetical victim wouldn't be notified, the researchers sent the file sharing request with the Gaia IDs, effectively converting the ID into an email address.

Thanks to Brutecat and Nathan's sleuthing, Google was able to lock down that vulnerability and prevent hackers from accessing everyone's email address associated with their YouTube accounts. The vulnerability was disclosed to Google in Sep. 2024 and was finally fixed on Feb. 9, 2025. That's a long time for potential exposure, but Google confirmed to BleepingComputer that there were "no signs that any attacker actively exploited the flaws."

In exchange for their work, the researchers received a cool $10,633. Phew, crisis averted.

Google has recently fixed a security flaw that exposed the email addresses of YouTube users, potentially leading to a massive privacy breach. The vulnerabilities were discovered by cybersecurity researchers Brutecat and Nathan, and have since been addressed by Google, as reported by BleepingComputer.

The breach of privacy could have affected all YouTube accounts, especially those of content creators, investigators, whistleblowers, and activists who keep their identities anonymous for safety reasons. Exposing their emails could have had serious consequences.

Brutecat found that blocking a user on YouTube revealed a unique internal identifier called a Gaia ID, which is used across all Google platforms. By accessing the block function through a user's live chat profile, they were able to trigger an API request that revealed the Gaia ID.

The researchers then discovered a way to convert these Gaia IDs into email addresses by exploiting a bug in Google's Recorder app for Pixel devices. They were able to send file sharing requests with the Gaia IDs, effectively revealing the associated email addresses.

Thanks to the efforts of Brutecat and Nathan, Google was able to fix the vulnerability and prevent hackers from accessing users' email addresses. The vulnerability was disclosed to Google in September 2024 and was fixed on February 9, 2025. Fortunately, there is no evidence that the flaws were actively exploited by attackers.

As a reward for their work, the researchers received $10,633. This incident serves as a reminder of the importance of cybersecurity and the ongoing efforts to protect user privacy online.