original content

Security researchers have identified a 12-year-old data-stealing attack known as Pixnapping, which targets web browsers to extract sensitive information from Android devices. This attack allows a rogue Android application to access and leak information from various apps, including Google Maps, Signal, and Venmo, as well as websites like Gmail, and can capture two-factor authentication codes from Google Authenticator. The attack utilizes a hardware side channel to access screen display pixels, employing techniques inspired by earlier research on timing attacks. A collaborative team from institutions like UC Berkeley and Carnegie Mellon University developed the modern iteration of Pixnapping, which will be presented at the 32nd ACM Conference on Computer and Communications Security. The Pixnapping framework enables a malicious app to push pixels into the rendering pipeline and read them by overlaying semi-transparent Android Activities. The attack systematically measures rendering times to infer pixel colors, allowing for the recovery of data through optical character recognition. Researchers successfully demonstrated Pixnapping on Android versions 13 to 16 across devices like the Google Pixel series and Samsung Galaxy S25. The attack does not require special permissions and exploits how the Mali GPU implements data compression, resulting in data-dependent rendering times. Pixnapping leaks only 0.6 to 2.1 pixels per second, which is still sufficient to recover Google Authenticator codes. Google has issued a patch for the underlying vulnerability tracked as CVE-2025-48561, with another patch planned for December, although there has been no evidence of exploitation in the wild. Despite attempts to mitigate Pixnapping, researchers have identified a workaround and suggest limiting an attacker's ability to compute on victim pixels as an effective strategy. They also discovered methods for attackers to identify all installed apps on a device, a capability restricted since Android 11 for privacy reasons, with Google indicating that fixing this issue may not be feasible.