Pixel-stealing “Pixnapping” attack targets Android devices

Researchers at US universities have demonstrated a malicious Android app technique that tricks the system into leaking pixel data, a concept they describe as the Pixnapping attack. The team from UC Berkeley and San Diego, the University of Washington, and Carnegie Mellon University built a pixel-stealing framework that can bypass browser protections and lift secrets from non-browser apps such as Google Maps, Signal, Venmo, and websites like Gmail, even stealing 2FA codes from Google Authenticator.

Pixnapping is a classic side-channel attack that relies on observing physical clues from how pixels behave, and the researchers tested it on modern Google Pixel phones (6, 7, 8, 9) and a Samsung Galaxy S25, succeeding in extracting secrets from both browsers and non-browser apps. They disclosed the findings to Google and Samsung in early 2025; as of October 2025 Google has patched part of the vulnerability, with further workarounds and a full fix still in progress.

The underlying vulnerability is tracked as CVE-2025-48561, and the paper shows that the attack could steal temporary 2FA codes in under 30 seconds once a Pixnapping app is installed. Consumers are advised to update devices, review app permissions, and enable Play Protect while patches roll out.