GmsCore leaking Google account password on login

Describe the bug
On login, there are logs with D tag from GmsAuthLoginBrowser shows my Google account mail address and password. It even shows up when adb is run without root, which is not good for security.

Steps to reproduce the behavior:

1. Open MicroG Settings
2. Add a Google account
3. Login with your Google account
4. Check logcat with adb logcat | grep GmsAuthLoginBrowser

Expected behavior
No passwords should be shown in logcat.

System
Android Version: R
Custom ROM: CAOS v313

Additional context
If you have 2FA enabled (SMS code, call, etc) it will show the code too.
09-19 07:55:44.497 6278 6464 D GmsAuthLoginBrowser: JSBridge: getDroidGuardResult: ["nullnull4null9nullnullnullnullnullnullnullnull239405null2"]
The login code was 239405

Can confirm , it does this for me as well.

[binary-glitch00103011]

Can confirm, research is being done to exploit.

[AnierinBliss]

Pretty sus

[Razuuu]

amogus sus

[akc3n]

Thanks @flawedworld for pointing out that this has been around for 7 years.

GmsCore/play-services-core/src/main/java/org/microg/gms/auth/login/LoginActivity.java

Line 445 in 96cfe2b

Log.d(TAG, "JSBridge: getDroidGuardResult: " + s);

[Terminator-J]

... as they said at Chernobyl:
"Whoopski."

[Dark-Matter7232]

NSA connection confirmed.

[DraconicNEO]

Just confirmed this for myself. This is a pretty serious bug, might want to get on this soon.

[binary-glitch00103011]

I have ethics most could appropriate. However in 3 days, I've worked it out, without a CEH or any formal training. It's trivial so no need to release a white paper, or a whack-a-mole proof-of-concept, I've made my point; but who else, that isn't so forthcoming? My research makes no noteworthy revelations and wouldn't aid in the development of better security, thus I'll refrain.

[dimaryaz]

Hey guys, I have a workaround for everyone: don't give adb access to anyone you don't trust! adb lets you do all kinds of bad things.

Also, if you think leaking the password to adb log is bad, I have even worse news for you. MicroG also sends your password over the internet, to a company known for making money off of users' data: Google!

But seriously: yes, it's a bug, but it's not the end of the world.

[binary-glitch00103011]

My method requires native exicution but requires no permission hence it would require creative deployment, many methods of which are well known. Your right dimaryaz, remote console is another angle, which could be mitigated with simple settings discipline. Sorry, the word choice is to obfuscate, I fear I spell out the obvious too much as is. Agreed, this is an important bug, and a seurity concern, but far from the end of the world. PCAP logs show that plain passwords aren't exposed so it seems it's local logs only. This without even peeling at code, but now I'm curious, thought I'll likely be quickly out of my depth.