A critical security flaw in Android allows attackers to steal sensitive information by analyzing screen pixels—without requesting any system permissions.
What is Pixnapping?
The attack, dubbed "Pixnapping," works through a malicious app that:
- Requires no system permissions from the victim
- Reads information displayed by other apps on screen
- Analyzes specific pixels to map letters, numbers, and shapes
Attack Success Rates
Testing revealed alarming results on Google Pixel devices (6, 7, 8, and 9):
- 2FA codes recovered: 29% to 79% success rate
- Average extraction time: 14 to 25 seconds
- Target: 6-digit authentication codes
Google's Response
- Mitigations released: Last month
- Additional patch: Coming in December's Android security bulletin
- Current status: No evidence of malicious exploitation detected
How It Works
The vulnerability (CVE-2025-48561) exploits Android's screen rendering by reading pixel-level data without triggering permission requests that would normally alert users to suspicious activity.
Stay Protected: Update your Android device immediately when December's security patch becomes available. Source: Ars Technica
