How a Smart TV Is Made: Panel, SoC, OS, Firmware and Viewing Data

A smart TV is a display panel with a small computer bolted to the back. The panel and backlight make the picture; a main board built around a media system on chip (SoC) runs a Linux based operating system, decodes video, drives the panel through a timing controller and talks to your network over Wi-Fi and Ethernet. That computer is flashed with firmware at the factory, updated over the air for years, and on many sets it also fingerprints what is on the screen and reports it to the platform, a practice called automatic content recognition (ACR) that you can usually switch off.

This post goes one level deeper than our walkthrough of how OLED and LCD panels are made, which stops at the finished glass. It follows the panel into a television: the boards around it, assembly and test, the operating system layers and who maintains them, signed updates, what ACR does with the picture, the FTC's 2017 viewing data case and the discovery protocols a TV exposes at home. It ends with steps to switch off ACR, check firmware and isolate the TV, and with what US, UK and EU rules ask of TV makers. Where makers keep numbers private, such as line yields or burn-in times, we say so instead of guessing.

Key takeaways

• A smart TV has five main blocks: panel and backlight, a timing controller (T-con), a main board with the SoC, memory and flash, a power board, and a Wi-Fi and Bluetooth module.
• The main board is a Linux computer running a TV platform such as Android TV and Google TV, webOS or Tizen. It is the part that gets security updates.
• Android based TVs use AOSP's A/B (seamless) updates and Verified Boot, which checks each boot stage and blocks rollback to older images.
• A 2024 peer reviewed study calls ACR "a Shazam-like technology" built into the TV's own OS. It found ACR traffic even when the TV was a plain HDMI display, and found that opting out stopped it on both platforms tested.
• On 6 February 2017 the FTC and New Jersey announced a $2.2 million settlement over second by second viewing data collected from 11 million TVs without informed consent.
• TVs announce themselves on the LAN: DIAL uses SSDP on 239.255.255.250 port 1900, casting uses Multicast DNS on 224.0.0.251 port 5353, and HDMI-CEC lets anything on the HDMI bus power the TV and switch inputs.
• UK PSTI (since 29 April 2024) requires a published security update period. The EU CRA's reporting duties apply from 11 September 2026 and its main duties from 11 December 2027. The FCC's Cyber Trust Mark is not yet accepting product applications.

From glass, silicon and plastic to a boxed TV in one table

This table is the map for the rest of the post. TV makers and panel makers do not publish per-station yields, burn-in durations or calibration tolerances for each model, so the table names the check at each stage rather than inventing numbers.

Two things in this table matter most for security. The first is step 5, where the device gets its identity and keys and where the secure boot root of trust is set. The second is the last column of step 11: a TV that sat in a warehouse for months will boot with old firmware and needs its first update before you trust it.

What is inside a smart TV?

A modern flat panel set has fewer boards than you might expect: a panel module, one main board, one power board and a small wireless module, plus speakers and cables.

Panel and backlight

On an LCD set the liquid crystal cell does not make light; it is a grid of shutters in front of a backlight. Cheaper sets use edge lit LED strips with a light guide plate; better ones use a direct lit LED array, and mini LED sets split thousands of small LEDs into local dimming zones. On an OLED set each subpixel emits its own light, so there is no backlight unit. Our panel post covers how the glass itself is made. The TV maker receives it as a module with source driver chips bonded along its edges.

Timing controller (T-con)

The T-con sits between the main board and the panel. It turns each video frame into the timing and data signals the panel's row and column drivers need, and often applies panel specific corrections such as overdrive or, on OLED sets, compensation for uneven wear. It has its own firmware and calibration data, which is why a panel swap repair often needs matching T-con settings.

Main board and SoC

The main board is the computer. Its media SoC combines CPU cores, a GPU for the interface, hardware video decoders, a display engine, audio processing and controllers for memory, flash, USB, Ethernet and HDMI. Around it sit DRAM, eMMC flash holding the operating system, HDMI receivers, a broadcast tuner and a low power controller that handles the remote and HDMI-CEC while the main system sleeps. AOSP's HDMI-CEC page describes exactly this split: the CEC hardware layer can hand control to a separate microprocessor while Android is in standby.

The SoC also holds content protection keys. Streaming services generally require device unique keys, provisioned at the factory or derived from keys fused into the SoC, which is one reason secure boot and signed firmware matter on a TV.

Power board

The power board turns mains AC into DC rails and on LCD sets often drives the backlight LEDs. A small standby rail keeps the remote receiver and network wake circuits alive when the TV is "off". The European Commission notes that since 1 March 2021 EU rules require smart TVs to ship with networked standby disabled by default, and ENERGY STAR requires certified TVs to use 0.5 watts or less in sleep mode.

Wi-Fi, Bluetooth, speakers and remote

A combination Wi-Fi and Bluetooth module connects to the main board over USB, SDIO or PCI Express and runs a firmware blob loaded by the Linux driver, part of the TV's software supply chain even though the TV maker did not write it. Bluetooth carries the voice remote, headphones and controllers. Many sets and remotes also include microphones for voice assistants.

How is a smart TV assembled and tested on the line?

TV assembly mixes automated board lines with manual or semi-automated final assembly, because a 65 inch panel is large and fragile. Makers do not publish yields, takt times or ageing durations, so this is the sequence, not the numbers.

Boards. Main, power and wireless boards are built on surface mount lines, as our printed circuit board post describes, then the main board goes to a fixture that loads or verifies the factory image and exercises every interface. This is where the TV gets its identity: MAC addresses, a serial number, device credentials for streaming services and, on secure boot designs, the hash of the maker's signing key written into one-time programmable fuses so the boot ROM rejects any unsigned bootloader from then on.

Backlight and module. For LCD sets, the backlight (LEDs, reflector, diffuser and optical films) is built behind the open cell in a clean area, since dust shows up as spots. OLED modules skip this.

Set assembly, ageing and calibration. Boards, speakers and cables are mounted on the chassis and the back cover fitted. Many factories then run sets on powered racks showing test patterns to catch early failures, after which a probe or camera measures the screen and the line writes white balance and gamma corrections into memory.

Final inspection. Network, Wi-Fi, Bluetooth and remote tests, a firmware version check, factory test mode switched off, and a reset to the out-of-box state before labelling and packing.

Which operating systems do smart TVs run?

Almost every smart TV runs a Linux kernel. What differs is the platform on top: app framework, home screen, store, accounts and data services. The table describes each family only from its own documentation. It is not a ranking.

Android TV and Google TV in more detail

On Android based TVs, live TV and HDMI inputs are not ordinary apps. AOSP explains that TIF consists of a TV Input Manager, TV Inputs (apps that represent physical or virtual tuners and input ports) and a TV Input HAL, and that the TV App is "a system app that can't be replaced by a third-party app". The HDMI and tuner paths belong to the platform and the device maker, not to apps you install.

CEC goes through HdmiControlService, guarded by the SignatureOrSystem protection level so only system components can use it, "to protect the service from abuse by apps with malicious intent". A TV sets ro.hdmi.device_type=0; a streaming stick sets 4.

Google TV's "basic TV" mode works without an account or internet, but Google's help page warns: "Without an internet connection, your device won't get important security updates." That trade off holds for every smart TV: the connection that carries data collection also carries the patches.

Who maintains which layer

A TV image comes from at least four sources, each on its own schedule: the SoC vendor's board support package (bootloader, kernel, drivers, closed libraries), the platform (framework, media stack, browser engine, store), the TV maker's layer (menus, ACR and ad services, voice integrations, update client) and apps, updated through the store rather than with firmware.

The kernel shows how these schedules collide. kernel.org's releases page, fetched on 24 October 2026, projects end of life in December 2026 for the 5.10 and 5.15 long term branches, December 2027 for 6.1 and 6.6, and December 2028 for 6.12 and 6.18. A 2026 TV on a 5.15 based SoC kernel outlives upstream support within months; after that, every kernel fix is a backport by the SoC vendor or TV maker.

How are TV firmware updates delivered, and how long are TVs supported?

Updates arrive over the air (the TV polls the maker's server and installs automatically or after a prompt), by USB (a file from the maker's support site, for sets that are never connected), or in some markets inside the broadcast signal.

Signed images, A/B slots and rollback protection

AOSP documents the machinery for Android based TVs. OTA updates upgrade the operating system, the read-only system apps and time zone rules, while store apps update separately. With A/B (seamless) updates the system keeps running from the current slot while the update is written to the unused one, which "makes updates fault resistant"; as of Android 15, non-A/B updates are deprecated. Verified Boot then builds a chain of trust from a hardware-protected root of trust through the bootloader to each verified partition, and its rollback protection ensures devices "only update to newer versions of Android". In plain terms, the image must carry the maker's signature, and an attacker cannot reinstall an older signed image to bring back a fixed bug. Vendor platforms document their mechanisms less publicly, but signed packages and anti-rollback are what NIST's consumer IoT baseline (NIST IR 8425, September 2022) asks for in its software update capability.

How long support lasts

• UK PSTI requires makers to publish the "minimum length of time security updates will be provided", with an end date, for consumer connectable products, smart TVs included, sold since 29 April 2024.
• EU CRA requires a declared support period whose end date, with month and year, is shown at purchase.
• EU ecodesign for electronic displays (Regulation (EU) 2019/2021, applying since 1 March 2021): the European Commission says parts that easily break must stay available for at least seven years after a model leaves production, and "This also applies to repair instructions and software updates." Annex II is widely quoted as requiring the latest firmware security update for at least eight years after the last unit is placed on the market; we could not retrieve the official text directly, so check Annex II before relying on that figure.
• FCC Cyber Trust Mark registry entries, once live, will show "The product's minimum support period end date".

Worked example: kernel support versus TV support

A TV launches in March 2026 on a Linux 5.15 based kernel and promises updates to March 2033. With 5.15's projected end of life in December 2026, the maker backports kernel fixes alone from January 2027 to March 2033, about 75 months. On a 6.12 based kernel (end of life December 2028), the gap would be about 51 months. The kernel base is worth asking about before buying a fleet of displays for an office or hotel.

What is automatic content recognition (ACR)?

Automatic content recognition is software built into a smart TV that identifies what is on the screen by taking periodic fingerprints of the picture or sound and matching them against a reference library. A 2024 study presented at the ACM Internet Measurement Conference, "Watching TV with the Second-Party", describes ACR as "a Shazam-like technology": the TV periodically captures what is on screen and matches it against a content library. The authors explain that each fingerprint is in effect a hash of the content, which the server matches to work out exactly what is playing.

How the fingerprinting works

Conceptually, ACR has four parts:

1. Capture. The TV samples frames (and sometimes audio) from the video pipeline at a fixed interval. Because it reads from the display path rather than from an app, it can see whatever the panel is showing: antenna broadcasts, a cable box, a game console or a laptop over HDMI.
2. Fingerprint. The client reduces each sample to a compact signature, small enough to send often without much bandwidth.
3. Match. The TV sends fingerprints, often batched, to the ACR provider's servers, which compare them against fingerprints of programmes, films and adverts.
4. Use. The matched viewing record is tied to the TV, and through account, advertising ID or IP address to a household, and used for audience measurement, recommendations and ad targeting, including on other devices.

The study measured two major smart TV platforms in the UK and the US. Citing each maker's own documentation, it reports that one platform's ACR captures frames every 10 milliseconds and the other's every 500 milliseconds, and its traffic analysis suggested the second batches captures and sends fingerprints about once a minute. Its main findings:

• ACR traffic was highest when watching linear TV and when the TV was used as an external display over HDMI. In other words, ACR kept working when the TV was just a "dumb" monitor.
• ACR traffic was not present when streaming from third party apps such as large subscription video services; the paper measures this but does not establish why.
• Logging in or out of the TV account made no difference.
• Opting out through the TV's own privacy settings stopped traffic to the ACR domains the authors had identified, and no new ACR domains appeared.
• ACR behaved differently in the UK and the US.

The study did not decrypt the ACR payloads, so it shows when and how much the TV talks to ACR servers, not exactly what each message contains.

What the FTC found in its 2017 smart TV case

On 6 February 2017 the US Federal Trade Commission and the Office of the New Jersey Attorney General announced that a TV maker would pay $2.2 million to settle charges that it collected viewing histories from 11 million smart TVs without consumers' knowledge or consent. The FTC's press release and business guidance post set out the allegations:

• Starting in February 2014, the company's TVs captured second by second information about what was displayed, including content from cable, broadband, set-top boxes, DVD players, over-the-air broadcasts and streaming devices.
• The FTC's business blog says the TVs sampled pixels on the screen and matched them to a database of TV, film and commercial content, capturing "as many as 100 billion data points each day from millions of TVs", and that the company retrofitted older models by installing the tracking software remotely.
• The data was sold to third parties, combined with household demographics such as sex, age, income, marital status, household size, education and home ownership, and used for purposes including targeting adverts to consumers across their devices. The company provided consumers' IP addresses to data aggregators, which matched them to individuals and households.
• The feature sat behind a setting called "Smart Interactivity", described only in terms of programme offers and suggestions.

The money was split as $1.5 million to the FTC and $1 million to the New Jersey Division of Consumer Affairs, with $300,000 of the New Jersey amount suspended. The stipulated court order required the company to "prominently disclose and obtain affirmative express consent" for collecting and sharing viewing data, prohibited misrepresentations about privacy, required deletion of data collected before 1 March 2016, and required a comprehensive data privacy program with biennial assessments. The Commission vote was 3-0.

The lesson the FTC drew for every connected device maker was simple: explain data collection plainly, get opt-in consent before collecting something as revealing as what a household watches, and do not hide the switch behind a vague label. If your TV shows a viewing data consent screen during setup, that is the place to say no.

What do HDMI-CEC, casting discovery and UPnP expose?

A smart TV talks on two networks: the HDMI bus and your home IP network. None of these protocols is a vulnerability in itself; each trades some exposure for convenience.

HDMI-CEC on the HDMI bus

Consumer Electronics Control is a low speed control channel on its own HDMI pin. AOSP describes features such as remote control passthrough, system audio control and One Touch Play, which lets a source device turn on the TV and switch it to the right input. Since Android 12, an Android playback device that wakes tries to wake the TV and become the active source. The exposure is local and physical: anything plugged into an HDMI port can power the TV on or off, switch inputs or send key presses, and AOSP notes that makers implement CEC differently. Turn it off in meeting rooms and hotels where untrusted devices get plugged in.

DIAL and SSDP

DIAL (DIscovery And Launch) lets a phone find a TV and launch an app on it. Its site contrasts the old flow of typing a 9 digit pairing PIN with simply tapping "Play on TV", and says the only requirement is that the phone and the TV share a home network.

The specification builds discovery on SSDP from UPnP: the client multicasts an M-SEARCH to 239.255.255.250 on UDP port 1900 with search target urn:dial-multiscreen-org:service:dial:1; the TV replies with the location of its UPnP device description, and fetching that returns an Application-URL header pointing at the DIAL REST service, where apps are queried and launched over HTTP with an optional argument. The spec says applications "MUST NOT assume that any security checks (such as character-encoding checks) have been performed" on that argument, and later versions require Cross-Origin Resource Sharing checks so only an app provider's authorised web origins can call certain URLs. Neither is user authentication: DIAL trusts the local network, so anyone on the same segment can discover the TV and ask it to launch a supported app.

Multicast DNS, DNS-SD and UPnP media services

Many casting protocols find TVs with Multicast DNS (RFC 6762, February 2013) and DNS-Based Service Discovery (RFC 6763). Queries go to 224.0.0.251 (FF02::FB on IPv6) on UDP port 5353; DNS-SD lets a phone browse for a service type and get each device's name, address, port and text records, which often include a friendly name like "Living Room TV" and a model identifier. Many TVs also run UPnP media renderer services, discovered through SSDP, whose device descriptions list maker, model and firmware version.

How to turn off ACR, reset the ad ID, check firmware and isolate your TV

Menu names change between firmware versions, so treat the names below as pointers and look for the closest match on your set.

Step 1: Update the firmware first

Do this first, because a major update can reset or add consent screens.

1. Open Settings, then Support, About or System, and find the software update item.
2. Run a manual check, install anything offered and turn on automatic updates.
3. Note the firmware version and, on Android based TVs, the security patch level under About.

For a set that is never connected, download firmware for your exact model number (check the label on the back) from the maker's support site and install it from USB.

Step 2: Turn off ACR and viewing data

Look under Privacy, Terms and Policies or User Agreements for anything mentioning viewing information, viewing data, content recognition, live TV recommendations or "interactivity", and switch it off.

The 2024 IMC study lists what its authors turned off. On one platform: the "viewing information agreement", voice information and interest based and cross-device advertising agreements, and content, AI and live recommendations, plus enabling "Limit ad tracking" and "Do not sell my personal information". On the other: "I consent to viewing information services on this device", interest based ads, a customisation service and personalised ads, plus enabling "Do not track". The pattern is usually one consent for ACR and several for advertising.

Step 3: Reset or delete the advertising ID

• Google TV: Settings, then Privacy, then Ads, then Reset advertising ID or Delete advertising ID. Google explains that resetting swaps in a new ID, while deleting means "a new one isn't assigned"; apps can still show ads, but not ads based on that ID.
• Android TV: Settings, then Device Preferences, then About, then Legal information, then Ads, then Reset advertising ID.

Other platforms usually have "Limit ad tracking", "Interest based ads" or "Advertising ID" under Privacy.

Step 4: Turn off what you do not use

• HDMI-CEC, if untrusted devices may be plugged in.
• Voice microphones you do not use; many sets and remotes have a hardware switch.
• "Wake on LAN", "wake on wireless" or "network standby", unless phones need to switch the TV on.
• Unused apps, especially preinstalled ones that ask for accounts.

Step 5: Check what the TV exposes on your network

Run these from a laptop on the TV's network, and only against devices you own or administer. On Linux:

# List every advertised service with resolved names and addresses
avahi-browse -art

On macOS:

# Browse for Google Cast receivers (Ctrl+C to stop)
dns-sd -B _googlecast._tcp local.
# Browse for AirPlay receivers
dns-sd -B _airplay._tcp local.

With the TV's address from your router's client list:

TV=192.168.20.15   # replace with your TV's address
# TCP ports the TV is listening on
nmap -Pn -p- --open "$TV"
# UPnP/SSDP description, including model and firmware strings
sudo nmap -sU -p 1900 --script=upnp-info "$TV"

On an Android based TV with developer options and network debugging on (press Build seven times under About):

adb connect 192.168.20.15:5555
adb shell getprop ro.build.fingerprint
adb shell getprop ro.build.version.security_patch
adb disconnect

Switch network debugging off afterwards; left on, it is a debug port for anyone on the network.

Step 6: Put the TV on its own network segment

The goal: the TV reaches the internet, your phones can still cast if you want, and nothing on the TV's segment can reach your laptops, NAS or work devices.

Easiest, a guest network. Most home routers offer guest Wi-Fi with no access to the main LAN. Casting then works only from phones on the same guest network.

Better, a dedicated VLAN with its own subnet and DHCP range: allow IoT to internet, block IoT to LAN, allow LAN to IoT if you cast. Our guide to building a home firewall on a mini PC covers VLANs in detail. A minimal nftables policy, with lan0 trusted and iot0 as the TV VLAN:

# /etc/nftables.d/iot.nft  (include from your main ruleset)
table inet iotfilter {
  chain forward {
    type filter hook forward priority 0; policy drop;
    ct state established,related accept
    iifname "lan0" oifname "iot0" accept          # LAN may reach the TV
    iifname "iot0" oifname "wan0" accept          # TV may reach the internet
    iifname "iot0" oifname "lan0" drop            # TV may not start connections to the LAN
  }
}

Load it with sudo nft -f /etc/nftables.d/iot.nft, then confirm the LAN can reach the TV and a device on the IoT VLAN cannot reach the LAN. Because mDNS and SSDP discovery do not cross subnets, casting across VLANs needs a discovery relay; relay only LAN to IoT, and only the service types you use.

Optional, DNS filtering of ACR and ad domains works as a backstop, but domains change and updates may share infrastructure. The 2024 study found the TVs' own opt-out stopped ACR traffic anyway, so use the settings first.

Step 7: Reset before you sell or give away a TV

Warning: a factory reset erases accounts, Wi-Fi passwords, paired devices and app data. First confirm it is the right set by matching the model and serial number under About with the label on the back, and sign the TV out of streaming accounts from their websites too, so a stale session cannot be reused.

What do the US Cyber Trust Mark, UK PSTI and the EU CRA mean for TV makers?

US Cyber Trust Mark. The FCC's voluntary label for wireless consumer IoT products is based largely on NIST criteria. A QR code will link to a registry entry showing how to change the default password, how to configure the device securely, whether updates are automatic and the minimum support end date. The FCC's examples of eligible products are cameras, voice shopping devices, appliances, fitness trackers, garage door openers and baby monitors; it excludes personal computers, smartphones and routers at first and does not mention TVs either way. As of 24 October 2026 the program is still being stood up: a new Lead Administrator took over effective 13 April 2026, a filing window for label administrators opened on 11 August 2026, accreditation bodies were recognised on 28 September 2026, and the FCC will announce when product applications open. No TV can carry the mark yet.

UK PSTI. In force since 29 April 2024 and covering smart TVs, it has three requirements: passwords unique per product or set by the user (not counters, public data or serial numbers); a published way to report security issues with response timescales; and a published minimum security update period with an end date. The Office for Product Safety and Standards enforces it.

EU CRA. Regulation (EU) 2024/2847 entered into force on 10 December 2024. Since 11 September 2026, makers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform: an early warning within 24 hours, a notification within 72 hours and a final report within 14 days of a fix. From 11 December 2027 they must meet the essential requirements and handle vulnerabilities in the product "including its components" for the whole support period. That phrase makes a TV maker answerable for the SoC vendor's kernel, the browser engine and every open source library in the image.

Common mistakes

• Treating the TV as an appliance. It is a networked Linux computer with accounts, microphones and DRM keys.
• Skipping the first update. Sets often ship with firmware months old. Update before signing in.
• Clicking through consent screens. Viewing data consent is easiest to decline at setup.
• Assuming HDMI is private. ACR was active over HDMI in the 2024 study. Turn it off before you mirror a work laptop.
• Leaving network debugging on after a one time check.
• Relying only on DNS blocklists. They break and can block updates; use the TV's opt-outs first.
• Sharing a network with work devices. Discovery protocols assume a trusted LAN.
• Buying without checking the support period, and forgetting to reset before resale.

FAQ

Do smart TVs watch what you watch?

Many do, through automatic content recognition, which fingerprints the picture or sound and matches it on the platform's servers. It is usually tied to a setup consent screen and can be turned off under Privacy.

Does ACR work on HDMI inputs like a game console or laptop?

On the two platforms in the 2024 IMC study, yes. ACR traffic was highest during linear TV and HDMI use, and opting out stopped it.

What was the FTC smart TV case in 2017?

On 6 February 2017 the FTC and New Jersey announced a $2.2 million settlement over viewing data from 11 million TVs collected without informed consent. The order required opt-in consent and deletion of data collected before 1 March 2016.

What operating system does a smart TV use?

Almost all run Linux, with a platform such as Android TV and Google TV, webOS, Tizen or a vendor platform on top.

How long do smart TVs get security updates?

It depends on the model. UK makers must publish an end date, and the European Commission says EU rules keep software updates available for at least seven years after a model leaves production.

Should I put my smart TV on a separate network?

Yes, if your router supports a guest network or VLAN. The TV keeps internet access for streaming and updates but cannot reach your other devices.

Can someone on my Wi-Fi control my TV?

Partly. DIAL and similar protocols trust the local network, so devices on the same segment can launch supported apps; full remote control usually needs an on-screen pairing prompt.

What is HDMI-CEC and should I turn it off?

It lets HDMI devices power the TV and switch inputs. Turn it off where untrusted devices get plugged in.

Is it safe to use a smart TV offline?

Offline removes ACR and network exposure but also security updates, as Google's basic TV page warns. Update first if you ever connect it.

Where Safeguard fits, honestly

Safeguard does not analyse TV hardware, scan firmware images, generate hardware bills of materials, manage devices or block tracking, and its models are single purpose security models, not tools for electronics or display work. The fit is the software around the TV that teams build: the home screen, the companion phone app, the casting receiver, the content backend, the update server and the build containers that produce images. Safeguard scans those repositories, container images and SBOM files for known vulnerable components with safeguard scan, shows which projects contain a given component and version, applies policies and gates, and can open fix pull requests for dependency upgrades when you turn autonomous remediation on (it ships switched off). The SoC vendor's closed drivers and the TV maker's firmware updates still have to come from them.

A TV image carries a browser engine, a media stack, TLS libraries and dozens of smaller open source packages, and the apps and services around it pull dependencies again on every build. The same remediation habits that keep a web service patched apply to the companion app and backend a TV talks to.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session. It installs the CLI, opens the interactive terminal and asks it to fix a lodash CVE in a repository; the assistant reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval and pushes nothing. The same flow fits a TV companion app, a casting receiver web app or a content backend that your team maintains.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and then scans from the terminal. That suits a team that builds TV apps or platform images on its own build hosts and wants the scan to run where the build runs, for example against a source tree or an SBOM file the build already produces.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. If your team already asks Claude about its projects, this is how the same conversation can look up which projects carry a vulnerable component when an advisory names a media library or browser engine that your TV software depends on.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

For more on the devices around your TV, see our posts on how a home router is made, IoT device security fundamentals, browser fingerprinting and replacing Google services.

Quick check

Sources

• FTC, VIZIO to Pay $2.2 Million to FTC, State of New Jersey to Settle Charges It Collected Viewing Histories on 11 Million Smart Televisions without Users' Consent (6 February 2017)
• FTC Business Blog, What Vizio was doing behind the TV screen (6 February 2017)
• Anselmi, Vekaria, D'Souza, Callejo, Mandalari and Shafiq, Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs (ACM IMC 2024), arXiv:2409.06203
• Full text, HTML version of arXiv:2409.06203
• Android Open Source Project, TV Input Framework
• Android Open Source Project, HDMI-CEC control service
• Android Open Source Project, OTA updates
• Android Open Source Project, A/B (seamless) system updates
• Android Open Source Project, Verified Boot
• Android Open Source Project, Android Security and Update Bulletins
• Google TV Help, Change ad settings for your Google TV
• Android TV Help, Change ad settings for your Android TV
• Google TV Help, Use basic TV on a Google TV device
• webOS Open Source Edition, Introduction
• Tizen Developers, documentation home
• DIAL, Overview
• DIAL, Protocol Specification (versions 1.7 to 2.2.1)
• DIAL reference implementation README
• IETF, RFC 6762, Multicast DNS (February 2013)
• IETF, RFC 6763, DNS-Based Service Discovery (February 2013)
• The Linux Kernel Archives, Releases
• NIST, IR 8425, Profile of the IoT Core Baseline for Consumer IoT Products (September 2022)
• ENERGY STAR, Televisions
• European Commission, Energy efficient products: electronic displays
• FCC, U.S. Cyber Trust Mark
• GOV.UK, The UK Product Security and Telecommunications Infrastructure (Product Security) regime
• European Commission, Cyber Resilience Act
• European Commission, Cyber Resilience Act: summary of the legislative text

Last reviewed: 24 October 2026.