What Happened
On June 9, 2025, Google patched a serious vulnerability in its account recovery process that could allow attackers to uncover private phone numbers tied to Gmail accounts . The issue was brought to light by a security researcher known as brutecat, who reported the flaw to Google in April.
How the Flaw Worked
Brutecat discovered that by chaining several vulnerabilities together—including leaking an account’s display name and bypassing Google’s anti-bot protections—an automated script could brute‑force the hidden digits of a user’s recovery phone number .
- Using Looker Studio, the researcher first gleaned the account’s display name.
- Then, by disabling rate limits, the script could cycle through phone number possibilities—sometimes revealing the full number in under 4 minutes, with most taking roughly 20 minutes .
TechCrunch confirmed the exploitation by creating a fresh Google account and supplying brutecat with its details—within minutes, brutecat retrieved the secret recovery number. Google promptly acted to close the loophole .
Why This Mattered
Privacy Risks
A recovery phone number, even if unlisted, serves as a crucial fallback for account breaches. Revealing it could enable targeted SIM‑swap attacks, where criminals gain control of your mobile line to intercept authentication codes and take over your Google account.
Security Rewards
After patching the flaw, Google awarded brutecat $5,000 via its bug bounty program . Thanks to this timely cooperation, there are currently no confirmed exploits stemming from this vulnerability. Google reaffirmed its commitment to working with the security community to protect users .
Strengthening Your Defenses
- Skip SMS-based 2FA: Consider switching to authenticator apps or hardware tokens, which don’t rely on phone numbers.
- Update recovery info: Ensure you’re using secure recovery methods—like a backup email or authenticator app.
- Stay alert: Monitor account recovery warnings and gym for unusual activity.
Conclusion
Google’s swift action to fix the bug that could reveal users’ private phone numbers reinforces how critical prompt vulnerability disclosure is. But this episode is also a reminder: phone numbers aren’t fully private, and SMS-based 2FA has inherent weaknesses. Strengthening your account with secure authentication tools is the best defense.
