San Diego

Recent findings reveal a vulnerability in Android devices from Google and Samsung that allows a sophisticated side-channel attack known as Pixnapping, enabling malicious actors to extract sensitive information such as two-factor authentication (2FA) codes and Google Maps timelines without user awareness. Pixnapping is a pixel-stealing framework that targets Android devices, circumventing browser protections and accessing data from non-browser applications like Google Authenticator. The attack exploits Android APIs and a hardware side-channel, allowing a malicious app to capture 2FA codes quickly. The study focused on devices running Android versions 13 to 16, with uncertainty regarding vulnerabilities in devices from other manufacturers. The attack can be executed by any Android app without special permissions, relying on user installation of the malicious app. It combines a previously disclosed vulnerability (GPU.zip) with Android's window blur API to leak rendering data. The attack manipulates the rendering pipeline to steal pixels from target apps. Three critical factors contribute to Android's susceptibility: the ability to send another app's activities to the rendering pipeline via intents, induce graphical operations on another app's pixels, and measure pixel color-dependent side effects from these operations. Google is tracking this issue as CVE-2025-48561, with a CVSS score of 5.5. Patches were released in the September 2025 Android Security Bulletin, but a workaround may re-enable Pixnapping. The vulnerability also allows attackers to determine installed applications on a device, bypassing restrictions from Android 11. Google has categorized this app list bypass as "won't fix."