The screen goes dark and the standby light blinks on.
Most people assume that is the end of it: the television is off, the room is private. A technical investigation into LG’s webOS platform, one of the world’s most widely deployed smart TV operating systems, found that a compromised set can keep its built-in microphone running, silently logging room audio long after the display shuts off. The question every owner of a connected television now has to sit with is simple: what is that standby light actually guarding?
How a sleeping TV keeps its microphone wide awake
Once a device is exploited, attackers can remotely activate the TV’s built-in microphone to record audio even when the set is in standby. The key word is “remotely”: the attacker does not need to be anywhere near the living room. Remote code execution flaws in the television’s operating system give an outsider the ability to run commands on the hardware as though they were sitting at the device itself.
During testing, the software continued recording room audio even when the television was severed from the internet, caching captured files in local onboard storage. Once connectivity returned, researchers demonstrated how an attacker could pull the stored audio remotely.
So even a brief moment of online access is all an attacker needs. The research team noted that this behavior does not mean the manufacturer is systematically recording conversations by default. Rather, it highlights an architectural vulnerability that leaves hardware open to remote eavesdropping if exploited by a malicious third party.
What the investigation found inside the hardware
Published on September 7 by Gamers Nexus working alongside Level1Techs and independent security researchers, the investigation puts a spotlight on two overlapping risks. The first is aggressive advertising surveillance that maps viewing habits and nearby devices. The second is a security flaw that could let an attacker turn the TV’s microphone into a living-room wiretap.
Packet captures and firmware analysis showed the tested sets identifying devices on the local network: phones, PCs, printers and smart-home hardware. The TVs also collected nearby Wi-Fi network names, signal data and device identifiers. That kind of network mapping without consent is separate from the microphone issue, but together the two data streams tell an attacker a great deal about who lives in a home and what they own.
ACR, or automated content recognition, fingerprints whatever appears on screen, whether a streaming show, a cable channel or a game, matching it against a reference database continuously, with no obvious indicator to the viewer.
Where the evidence stands and what has been confirmed
The investigation covered retail LG OLED models, including the 2025 flagship G5 running webOS, and the team reported undisclosed remote-code-execution vulnerabilities to the manufacturer under responsible disclosure, meaning full exploit details are withheld while the company reviews the flaws.
Researchers demonstrated a controlled compromise of a flagship model that recorded audio while the display appeared off, then exfiltrated the stored files after connectivity returned. That model is actively sold today and sitting in millions of US homes, not a years-old discontinued set.
This is also not the first time the platform has carried documented flaws. Bitdefender previously reported four vulnerabilities affecting webOS versions 4 through 7 running on LG TVs, which allowed researchers to gain root access after bypassing the authorization mechanism; LG patched those in early 2024. The current round of remote-code-execution vulnerabilities found by Gamers Nexus is still being actively assessed by the manufacturer.
Why smart TVs are harder to lock down than a phone or laptop
Most people update their phones automatically and keep laptops patched. Smart TVs occupy a different mental category: they are treated as appliances, not computers, even though they are internet-connected computers with microphones, app stores and access to every other device on the home network.
That gap is exactly what makes them attractive targets. A TV that stops receiving security patches but stays connected for another five years is an open door. Unlike a forgotten unused app subscription that drains money quietly, an unpatched TV can cost far more than dollars.
The broader pattern mirrors what security researchers found in networked robot vacuums and smart-home hubs: the convenience features that sell a product, a microphone, network awareness, a cloud connection, are exactly the features that widen the attack surface. According to the Bitdefender and NETGEAR 2025 IoT Security Landscape Report, the average household now runs 22 connected devices and faces roughly 29 attempted cyberattacks per household daily.
What owners can do while a patch is still pending
The practical options are limited but real. Disabling the microphone at the hardware level, using a physical mute button on the remote if one exists, removes the standby audio risk regardless of what the software is doing. Switching off ACR tracking inside the TV’s privacy settings stops the viewing fingerprint from leaving the home, though the setting is rarely surfaced prominently during setup.
Placing the television on a dedicated network segment, separate from phones and laptops, limits the blast radius if the device is ever compromised. A second network with client isolation means a compromised TV cannot reach a banking session on a nearby laptop. This costs nothing on most modern home routers and takes about ten minutes.
A patch is coming, but its timeline is unknown. Until it arrives, checking for firmware updates manually rather than waiting for an auto-prompt is the most reliable step any owner can take today.
