Serious Google Security Flaw Could Reveal Your Phone Number to Hackers

A critical security vulnerability in Google’s account recovery system could have allowed attackers to uncover phone numbers linked to any Google account. The issue, which was responsibly disclosed by Singapore-based cybersecurity researcher known as “brutecat,” has now been patched by Google following the report.

The flaw, which affected a now-deprecated version of the username recovery page, posed a serious risk to user privacy and account security. It enabled attackers to brute-force recovery phone numbers associated with Google accounts and potentially use them for SIM-swapping attacks or phishing campaigns.

The Vulnerability

The security loophole was discovered in a JavaScript-disabled version of Google’s username recovery page:
accounts.google[.]com/signin/usernamerecovery.

This page was originally designed to help users recover their Google usernames by checking if a recovery email address or phone number was linked to a particular display name (e.g., “John Smith”). However, the outdated version lacked standard anti-abuse protections such as CAPTCHAs or rate-limiting, making it vulnerable to automated attacks.

The researcher outlined a three-step method that could be used to exploit the flaw:

1. Obtain the User’s Display Name
   By creating a Looker Studio report and transferring ownership to a target email address, an attacker could trigger a notification that displays the victim’s full name on their Google homepage.

2. Reveal Part of the Phone Number
   Using Google’s “Forgot Password” feature, attackers could initiate a password reset for a target email address. This would show a masked version of the linked recovery phone number, revealing the last two digits (e.g., •• ••••••03) and the country code.

3. Brute-Force the Full Phone Number
   With the last two digits known and a rough idea of the number’s length, the attacker could then use automated scripts to try various combinations on the outdated recovery page. Since this version lacked CAPTCHA and throttling, it was possible to guess the full number in seconds or minutes, depending on the country.

For example, the researcher found that a Singapore-based phone number could be brute-forced in just 5 seconds, while a U.S. number might take around 20 minutes to unmask.

Once an attacker knows the phone number linked to a Google account, they can try more advanced attacks such as:

• SIM Swapping: By convincing a mobile carrier to transfer the number to a new SIM card, the attacker gains control of SMS-based verification messages, allowing them to reset passwords for associated services.

• Phishing or Social Engineering: Knowing someone’s personal number and display name can make fake messages seem more credible.

This vulnerability could have put millions of users worldwide at risk, especially those relying on their phone number as a primary recovery method for sensitive accounts.