Academic researchers have revealed a new Android vulnerability called Pixnapping that lets malicious apps steal 2FA codes, private messages, and other visible data without needing permissions. The attack, which takes less than 30 seconds, exploits screen rendering times and has been demonstrated on Google Pixel phones and the Samsung Galaxy S25. Google has released partial mitigations, with further patches planned.
The Pixnapping attack requires a victim to install a malicious app, which then uses Android programming interfaces to trigger targeted apps into displaying sensitive information on the screen. Without any special permissions, the app performs graphical operations on specific pixels and measures rendering times to reconstruct the data pixel by pixel, effectively acting like an unauthorized screenshot.
"Anything that is visible when the target app is opened can be stolen by the malicious app using Pixnapping," the researchers stated on their informational website. This includes chat messages, 2FA codes, and email content, but not hidden data like stored secret keys.
The process unfolds in three steps: first, the malicious app invokes APIs such as activities, intents, and tasks to scan for and open targeted apps, sending their data to the rendering pipeline. Second, it checks pixel colors at chosen coordinates, distinguishing white from non-white by overlaying malicious windows. Third, it combines rendering time measurements to rebuild the image.
Researchers tested the attack on Google Pixel 6, 7, 8, and 9 phones, successfully recovering full 6-digit 2FA codes from Google Authenticator in 73%, 53%, 29%, and 53% of trials, respectively, averaging 14 to 26 seconds. It was less effective on the Samsung Galaxy S25 due to noise. Lead author Alan Linghao Wang explained, "This allows a malicious app to steal sensitive information displayed by other apps or arbitrary websites, pixel-by-pixel."
Pixnapping echoes the 2023 GPU.zip attack, which used similar GPU side channels but was mitigated in browsers. Google issued a patch for CVE-2025-48561 in September, partially addressing the issue, with another in December. A Google representative noted, "We have not seen any evidence of in-the-wild exploitation." The research highlights limits in Android's app isolation, though real-world implementation challenges may reduce its practicality.