I don't see any stealing taking place here. Path doesn't access your location data as you instructed it. It accesses your photos' exif data which is a completel

I don't see any stealing taking place here. Path doesn't access your location data as you instructed it. It accesses your photos' exif data which is a completely different thing. Even if path didn't process and show in html these data, since you uploaded an image file which contains them, they would be available to anyone with access to this -now public- image through other means, like a simple browser plugin. Let's go over this again: you set path to not access your phone's location api, you didn't set path to strip your exif data from your photos. If this feature is missing, you can ask for it. Since you are a security researcher I would expect you to understand the real issue and warn your readers. Instead you act as you discovered a security flaw. What security issue you'll discover next? That credit cards have interest?