The question of whether Android TV box is safe has become one of the most asked technology questions in Türkiye in recent weeks. Lists listing "clean" and "risky" models are spreading rapidly on social media. However, most of these lists do not cite sources and put some models on the wrong side.
In this guide, we have compiled findings confirmed only by reliable sources: the XCPE backdoor that Google announced on November 3, 2026, the BadBox 2.0 operation that the FBI warned about, and how you can check whether a TV box is safe in your own home. We also explained step by step what to do if the box you have is risky.
Google found backdoors in 1.3 million TV boxes
In its report published on November 3, 2026, Google announced that it had detected a backdoor called XCPE in more than 1.3 million Android TV boxes. According to Google, the backdoor was intentionally placed in the firmware by Videostrong, the manufacturer of the boxes. Videostrong is the manufacturer of Mecool brand boxes, which are also sold in Türkiye.
Security firm Synthient was the first to spot the backdoor, finding the malicious code right out of the box on a purchased Mecool KM9 Pro Max box. The backdoor works with system privileges, turns off Google Play Protect and installs applications without asking the user. Many of the compromised boxes connect to "residential proxy" networks that use your home's internet connection for other people's traffic. Türkiye is also included in Google's distribution map, but the number of devices in Türkiye has not been disclosed. We explained the details of the development in our news that the backdoor in Android TV boxes has been closed.
Google revoked Videostrong's license to produce certified Android devices and shut down the servers running the botnet. Still, the code inside the boxes remains. Factory reset doesn't work because the backdoor re-installs itself on reboot.
BadBox 2.0: The operation the FBI warned about
The FBI issued a separate warning for the operation called BadBox 2.0 in June 2025. According to research by security firm HUMAN, more than 1 million devices were connected to this network from 222 countries and regions. The majority of affected devices were unbranded or little-known TV boxes, tablets and projectors without Google certification.
In the lawsuit filed by Google against BadBox 2.0 operators, the affected models are named X88 Pro 10, T95, MXQ Pro and QPLOVE Q9. The mention of the X88 Pro family, which is shown as "clean" in some lists on social media, in this case also shows why unsourced lists should not be trusted.
How accurate are the "clean" and "risky" lists on social media?
Most of the shared lists do not say which test they were prepared with. Synthient even emphasizes that for the 182 model names it found, a model name alone does not prove that the device carries malware. Boxes with the same name may come from different factories and with different software.
Therefore, it is better to decide whether a box is safe or not by looking at the model list, but by the concrete checks below. A box that is not mentioned in the list may also be risky, and a different version of a model that appears "risky" on the list may also be clean.
How to tell if Android TV box is safe?
The fastest check is made from the Google Play Store. Open the Play Store on your box, go to the profile icon or Settings, and look for the About section. If the "Play Protect certification" line says "Device certified", it means the box has passed Google's compatibility tests. If it says "uncertified" or there is no Play Store at all, you need to be careful.
Google acknowledged that some certified boxes were also affected in the XCPE incident; The malicious code was activated after the device was first turned on. That's why certification alone is not enough. See also these signs:
If there are applications such as "share your unused internet and earn money" in the box, uninstall them immediately.
If applications that you did not install appear on their own or Play Protect is disabled, the box is risky.
In the modem interface, see whether the box is sending heavy data even when you are not using it.
If there are no official versions of apps like Netflix, Disney+, and YouTube, the box is most likely uncertified.
What should you do if the box you have is risky?
If you think a box is risky, first disconnect it from the internet. Factory reset does not delete XCPE and BadBox type backdoors because the code remains in the part of the software that cannot be changed. Synthient and Google's recommendation is to retire these boxes completely.
If you must continue using the box, install only the official and clean software from the manufacturer, uninstall unknown application stores, and connect the box to a guest network separate from the computers on your home network. Also change the passwords of the accounts you use in the box.
What should you pay attention to when choosing a safe TV box?
Following the incident, Google recommends users only buy devices from well-known manufacturers and look at the list of certified partners at android.com/certified/partners. Models sold with Google TV or Android TV certification from brands such as Xiaomi, Google, Nokia, onn, Homatics and Thomson are a safer starting point in this respect. We still recommend checking the box's Play Protect certification before purchasing.
Price is also an important sign. In unbranded boxes that offer the same features at a much cheaper price, the cost is often reflected in the software. You can also check out our guide to the best Android TV box models for our current recommendations.
Frequently asked questions
Does factory reset delete the backdoor?
No. Since the XCPE and BadBox 2.0 backdoors are embedded in the system part of the software, it reinstalls itself after a reset. The permanent solution is to install clean official software or replace the box.
Is a Google certified box completely safe?
The certificate greatly reduces the risk, but does not reset it. In the XCPE incident, some certified boxes were also affected. For this reason, Google announced that it has tightened its certification process and software integrity checks.
What should I do if I have a Mecool box?
Google canceled the license of Videostrong, the manufacturer of the Mecool brand. If your box's software has not received a safe update from the manufacturer, the safest way is to disconnect the box from the internet and replace it.
How does my TV box put my home network at risk?
The compromised box can use your internet connection for other people's traffic, participate in ad fraud, and be an entry point for attacking other devices on the same network. Illegal traffic may appear to originate from your IP address.
