Play Store apps

A new side-channel attack called Pixnapping allows malicious Android applications to extract sensitive data without permissions by stealing pixels displayed by applications or websites. This attack can reveal private information, including chat messages from secure apps like Signal, emails from Gmail, and two-factor authentication (2FA) codes from Google Authenticator. Developed by a team of researchers, Pixnapping works on fully patched modern Android devices and can exfiltrate 2FA codes in under 30 seconds. Google attempted to address this vulnerability (CVE-2025-48561) in a September update, but the researchers bypassed these measures. A more robust solution is expected in the December 2025 Android security update. The attack begins with a malicious app exploiting Android’s intents system to launch a target app or webpage, processed by the system’s composition engine, SurfaceFlinger. The malicious app identifies target pixels by executing graphical operations and uses a 'masking activity' to conceal the target app. The attacker modifies the cover window to display all opaque white pixels except for the chosen transparent pixel. The isolated pixels are enlarged using a stretch-like effect when applying blur, and an OCR-style technique is then used to recover the pixels. The researchers utilized the GPU.zip side-channel attack to leak visual information, achieving a data leakage rate of 0.6 to 2.1 pixels per second, allowing sensitive data extraction in less than 30 seconds. Pixnapping was demonstrated on various devices, including Google Pixel and Samsung Galaxy models running Android versions 13 through 16, indicating that older Android versions are also at risk. An analysis of nearly 100,000 Play Store apps revealed hundreds of thousands of invocable actions through Android intents, highlighting the broad applicability of the attack. Examples of potential data theft include: - Google Maps: Timeline entries can take around 20–27 hours to recover. - Venmo: Account-balance regions can leak in approximately 3–5 hours. - Google Messages: Recovery requires roughly 11–20 hours. - Signal: Recovery takes about 25–42 hours, effective even with Screen Security enabled. Both Google and Samsung plan to address these vulnerabilities by the end of the year, but no GPU chip vendor has announced plans to patch the GPU.zip side-channel attack. Although the original exploit method was mitigated in September, an updated attack has successfully bypassed the fix. Google has indicated that exploiting this data leak requires specific information about the targeted device, resulting in a low success rate, and current assessments found no malicious apps on Google Play exploiting the Pixnapping vulnerability.