Over a third of the 6,038 smart TV apps Spur scanned across LG webOS and Samsung Tizen are running residential proxy SDKs that turn your living room into a traffic relay. That's 2,058 apps selling your public IP address while you watch a fish tank, a clock, or solitaire.
I've been saying for years that the least-audited computer on your home network is the one bolted to your wall. Now there's hard data.
Why TVs Are the Perfect Proxy Hosts
Smart TVs sit on the same LAN as your router, NAS, and security cameras. They don't have a battery to drain, no cellular bill to spike, no app switcher that flags background processes. Users treat them as furniture and never audit what runs after the screen saver fades in.
A TV can stay plugged in, signed in, and online for years while the proxy SDK quietly multiplexes strangers' traffic through your home connection. The user thinks they're looking at a digital painting. Under the hood, the app is a residential proxy endpoint.
The Consent Trick: Ask Once, Proxy Forever
Every proxy SDK Spur examined asks for permission exactly once, usually during initial setup. All three major SDKs (Bright Data, Honeygain/Oxylabs, Massive) include a background clause: the proxy keeps running even after the app is closed. The app goes away. The proxy does not.
Pac-Man on Tizen made the trade-off explicit: accept Bright Data's proxy SDK and the game becomes ad-free. Decline and you keep the ad-supported version. That's a clean monetization fork - watch ads or become part of the proxy network.
Who's Publishing These Apps? The Proxy Companies Themselves
This isn't just a story about developers embedding third-party SDKs. Spur found that Bright Data, Bright Data Ltd, and Bright SDK are the listed publishers for 367 proxy-flagged apps. Honeygain UAB, a subsidiary of Oxylabs, published 16 more.
Many of those apps are thin shovelware: screensavers, clock faces, simple utility shells. The app is the wrapper. The residential IP is the product. These look like first-party proxy inventory shipped at scale to give the SDK somewhere to run.
The Platform Gap: Amazon and Roku Say No, LG and Samsung Say Nothing
Amazon's Device and System Abuse Policy explicitly prohibits apps that facilitate proxy services for third parties. Roku reportedly shuts it down too - Lowpass (syndicated at The Verge) reported that Roku bars Bright SDK and similar services, and apps using them disappeared after Roku was contacted.
LG and Samsung have not drawn an equivalent public line. The same business model that Amazon bans and Roku blocks is still running at scale on webOS and Tizen.
The Real Danger: Not Just Your IP, Your Whole LAN
Once a TV app runs a proxy, the risk extends beyond someone borrowing your public IP. The app runs inside your home network. If the proxy provider's filters fail - or if they allow requests to private addresses - that TV becomes a foothold for reaching router admin panels, NAS devices, printers, cameras, and developer machines.
This is not theoretical. In January 2026, KrebsOnSecurity reported on the Kimwolf botnet, which abused residential proxy networks to tunnel back into the local networks behind proxy endpoints. Attackers used proxy access to reach devices on the same LAN as the proxy node and spread further from there.
The Bright Data SDK ships with an explicit private-range blocklist (127.0.0.0/8, 10.0.0.0/8, etc.), which is good to see. But the Massive and Honeygain/Oxylabs samples Spur examined did not contain comparable blocklists. The boundary between safe public-web traffic and a criminal VPN into your home network is enforced only by the proxy company's customer vetting, traffic filters, and internal rules. The device owner has no way to verify that boundary from the TV.
Spur's methodology is worth noting: they downloaded actual LG and Samsung app packages and unpacked them. That ground truth should worry anyone who treats their TV as an appliance. If your TV runs one of these apps, the only way to know the proxy isn't being abused is to trust the proxy company's word. I'd rather audit the device.
Source: Nearly half of LG smart TV apps contain residential proxy SDKs
Domain: spur.us
Comments load interactively on the live page.