New Delhi, Nov. 3 -- A set-top box plugged in beside a living-room television can quietly sell its owner's home internet connection to strangers. Google says that is what a Chinese manufacturer built into more than 1.3 million Android TV devices, and that it has now taken down the infrastructure behind the scheme.

In a report published November 2, Google's Threat Intelligence Group said it assesses with high confidence that Videostrong Technology Co., an Android device maker, deliberately developed and operated a backdoor it calls XCPE. Google worked with industry partners to dismantle it, cut ties with the company and banned it from making devices with preloaded Google apps.

The company says the backdoor was sold on to criminal affilia...