Pixnapping: Android timing side-channel exposes on-screen data

A team of academic researchers has disclosed a new Android vulnerability, called Pixnapping, that can extract sensitive information displayed on a phone screen, including two factor authentication codes, messages and location timelines, in under 30 seconds. The technique was demonstrated earlier this year on multiple Google Pixel models and on a Samsung Galaxy S25 running Android versions 13 through 16. Google has issued a partial mitigation in its September security bulletin and plans further fixes, but researchers say a workaround still allows the attack to succeed.

Pixnapping does not rely on screenshot or notification permissions. Instead, a malicious app that requires no special permissions can use Android intents to prompt a target app to render sensitive content, then layer semitransparent activities to mask all but selected pixels. By manipulating those pixels and measuring frame timing differences through a graphics side channel, the malicious app can infer pixel values and reconstruct onscreen text and images. Anything visible while a target app is opened can be recovered, the researchers said. Secret information that is never displayed, such as stored cryptographic...