Security & Privacy
2026.11.03·30 min read
When Google Certification Shields a Firmware Backdoor — Inside Videostrong's 1.47-Million-Device Android TV Betrayal
Google, Japan's National Police Agency, and five security partners dismantled the XCPE firmware backdoor preloaded onto 1,472,554 Android TV devices, taking the rare step of naming and permanently banning licensed certification partner Videostrong Technology (parent of MECOOL) while severing access to over 10 million downstream bots. By delaying payload execution until first internet boot to slip past factory testing, the vendor turned eFuse-locked bootloaders into a trap that blocks legitimate buyers from flashing clean open-source firmware.
AFeng