Pixnapping Android Flaw

Cybersecurity researchers have identified a critical vulnerability affecting Android devices from Google and Samsung, dubbed Pixnapping. This side-channel attack allows a malicious app to covertly steal sensitive data, including two-factor authentication (2FA) codes and Google Maps timelines, by capturing screen pixels without the user’s knowledge. The attack operates on a pixel-by-pixel basis, making it highly precise and stealthy.

How Pixnapping Works: Pixel-Stealing at Its Core

At its core, Pixnapping is a pixel-stealing framework designed to bypass standard browser mitigations and target non-browser apps such as Google Authenticator. It leverages Android APIs and a hardware side-channel to capture sensitive information rapidly, 2FA codes can be extracted in under 30 seconds.

The attack exploits Android’s rendering pipeline in a unique way:

• A malicious app forces victim pixels into the rendering pipeline using Android intents.
• It then applies a stack of semi-transparent Android activities to compute on those pixels.

This methodology mirrors 'Stone-style' attacks previously limited to browsers, now adapted for native apps.

Devices at Risk and Scope of the Vulnerability

The research specifically examined five Google and Samsung devices running Android versions 13 through 16. While other manufacturers have not been tested, the underlying principles of the attack exist on all Android devices, making the platform broadly susceptible.

Remarkably, any Android app can execute Pixnapping without special permissions in its manifest. However, the attack requires that the victim install and launch the malicious app, often through social engineering or trickery.

Technical Mechanics: GPU Side-Channels and Window Blur Exploits

Pixnapping builds on the previously disclosed GPU.zip side-channel (September 2023), which leveraged compression features in integrated GPUs to steal cross-origin pixels in browsers. The new attack expands this concept by combining it with Android’s window blur API, enabling the theft of pixels from victim apps.

The process works as follows:

• A malicious app sends victim app pixels into the rendering pipeline.
• Semi-transparent activities are overlaid using Android intents to mask, enlarge, and transmit targeted pixels.
• Each pixel containing sensitive data is isolated and extracted sequentially.
• This allows attackers to reconstruct 2FA codes or other confidential content pixel by pixel.

Why Android is Vulnerable: Three Enabling Factors

Researchers identified three conditions that make Pixnapping possible:

• Injecting activities from other apps into the Android rendering pipeline.
• Inducing graphical operations (like blur) on these pixels.
• Measuring pixel color-dependent side effects to infer sensitive information.

Google’s Response and Security Updates

Google has tracked Pixnapping under CVE-2025-48561 (CVSS 5.5). A patch was released in the September 2025 Android Security Bulletin, partially mitigating the attack. The patch addresses scenarios where excessive blurring could be used to steal pixels.

A second patch is scheduled for December 2025 to close a new attack vector that re-enables Pixnapping via timing adjustments. Google noted that exploitation requires device-specific data and confirmed no active malware exploiting this flaw on Google Play.

Additional Risks: App Detection and Privacy Implications

Pixnapping also allows an attacker to detect installed apps on a device, bypassing restrictions implemented since Android 11 designed to hide app lists.

The attack highlights the risks inherent to mobile app layering, a system where apps interact extensively across the OS. Restricting layered app functionality entirely is impractical; instead, defenses may focus on letting sensitive apps opt out and limiting attackers' ability to perform measurements.

Key Takeaways for Users

Pixnapping is a highly stealthy attack that operates without requiring elevated app permissions, making it particularly insidious. The risk increases when users install apps from untrusted sources, as malicious applications could exploit the vulnerability to access sensitive information. While Google has issued partial patches to address the issue, a full mitigation is expected in December 2025. In the meantime, users should remain vigilant, closely monitoring their 2FA apps and other sensitive data for any signs of unusual activity.