New Pixnapping Android Flaw Lets Rogue Apps Steal 2FA Codes Without Permissions

Pixnapping, a side-channel attack named by researchers from UC Berkeley, UW, UC San Diego and CMU, targets Google and Samsung Android devices and can steal 2FA codes and other sensitive data pixel-by-pixel without requiring extra permissions. The attack works by steering victim app pixels into the rendering pipeline and using a stack of semi‑transparent activities to extract the codes from specific pixels, operating on devices running Android 13 to 16.

According to Google, the issue is tracked under CVE-2025-48561, and patches were issued in the September 2025 Android Security Bulletin, with the firm noting that an application requesting lots of blurs can enable pixel stealing. The study also shows that an attacker could determine whether an arbitrary app is installed, bypass­ing newer package-visibility restrictions, a bypass that Google says won’t be fixed. A workaround exists to re-enable Pixnapping, and Google and researchers alike say a fix is still in progress. 14 October 2025.