LG Smart TV Research Alleges Standby Audio Collection and webOS RCE Flaws

Researchers from Gamers Nexus, Level1Techs, and independent teams allege that tested LG OLED televisions—including a retail 2025 G5—conducted local-network device discovery, collected nearby Wi-Fi identifiers, and processed microphone audio while appearing to be in standby. They reported that speech-derived logs and audio could be retained locally while the TV was offline, then uploaded after connectivity returned, reportedly to infrastructure associated with LG Ad Solutions. The investigation also found LG’s Automatic Content Recognition (ACR) operating across inputs, including HDMI, raising privacy concerns for home, healthcare, and corporate deployments.

The researchers further disclosed alleged, unpatched remote-code-execution vulnerabilities in webOS network-facing services to LG and demonstrated a controlled proof of concept, though no CVEs or public fixes were cited and responsible disclosure remains in progress. A successful compromise could turn a TV into an audio-surveillance endpoint and provide an attacker a foothold on the surrounding network. LG had not publicly responded to the specific findings at publication; the allegations conflict with its existing statement that its TVs do not collect, record, or store ambient conversations. Organizations should apply available firmware updates, disable unnecessary privacy and UPnP features, and isolate TVs on an IoT or guest network.