WARNING: Google Play Services is quietly "Self-Verifying" and linking your phone number to ALL signed-in accounts without explicit permission.

Just a heads up for anyone who values basic privacy on Android.

Check your inbox for emails from noreply-phone-verification@google.com.

Without asking for my confirmation or giving me an opt-in prompt, Google Play Services performed a silent background "Self-Verification."

It exchanged SIM card identifiers and device metadata with my mobile carrier, grabbed my phone number, and automatically attached it to EVERY Google account logged into my phone.

No prompt. No "Do you want to link this?" button. Just a silent background action followed by a notification email telling me it already happened.

How to kill this setting on Android immediately (for now) but it will self verify even if turned off Go to Settings > Google (or Google Services) > All Services > Phone Number Verification

Find Phone number verification (or Device Phone Number Verification). (Ah, and lovely it automatically appear my phone number even WHEN IT WAS NOT THERE BEFORE!)

TOGGLE IT OFF.

Don't forget to purge your accounts:

Once Google steals/verifies the number, it pushes it to your Google account profiles.

You need to log into myaccount.google.com/personal-info, click on Phone, and manually delete the number from every single account where you don't want it stored.

Modern "self-verification" dark patterns are completely out of hand. Check your settings before Google silently grabs your data too.

NO ANDROID IS SAFE: Happened on my Android 10 Huawei, Android 14 Xiaomi and is now requesting on my emulators too...even my tablet... Beware...

Edit1: Maybe dont work, i sent a mail to data-protection-office@google.com, literally asking ARCO rights and anything i can think about it, for such privacy invasion on the behalf of my and all accounts i have to "care" and so on...maybe this bring pressure

Edit2: u/AppleBites reports this "Google did the same to me when I got a 2nd number from another carrier, due to coverage. Even having GrapheneOS did not prevent them from linking the number to my Google account automatically."

Meaning even Graphene OS+GServices probably is unable to protect with this, a serious oversteeping in this messed thing

Hey everyone,

I recently stumbled upon a pretty glaring privacy/security oversight on Realme devices involving the File Dock feature, and I wanted to see if anyone else has noticed this.

What happens:

While viewing a "view-once" (ephemeral) image on apps like WhatsApp or Instagram, if you accidentally or intentionally press and hold down on the image, you can drag and drop it directly into the system's File Dock panel on the side of the screen.

Instead of capturing a temporary block or failing due to screen security flags, the system overlay intercepts the rendered image data and lets you drop it as a permanent, raw copy into the dock. From there, you can paste or move it anywhere outside the app, completely defeating the purpose of view-once media.

Why this is an issue:

System-level multitasking features like File Dock or Smart Sidebar seem to sit at a compositor layer that captures screen elements before the app's internal security flags (FLAG_SECURE) and deletion timers can wipe them.

Device tested: Realme P4 (Realme UI)

Status: The copied asset persists indefinitely in the dock until manually deleted.

Has anyone else experienced this on Realme UI, or similar sidebars on Oppo/OnePlus (ColorOS/OxygenOS) devices? Thought it was worth bringing to light so people are aware of how system overlays interact with app-level privacy protections

RELEASED ON GITHUB

https://www.reddit.com/u/typongtv/s/a48EWQhmx2