No fix yet for attack that lets hackers pluck 2FA codes from Android phones

Ars Technica reports that researchers have unveiled Pixnapping, an Android vulnerability that can covertly steal 2FA codes, location timelines, and other data in under 30 seconds, starting from a malicious app that requires no system permissions. The attack works by reading data shown on screen and using pixel-level timing measurements to reconstruct information such as 2FA codes, with demonstrations on Google Pixel phones and the Samsung Galaxy S25.

Google has released a patch for CVE-2025-48561 in the September Android security bulletin and says an additional patch will be issued in the December Android security bulletin, though a modified version of the attack can still work even after the update. In testing, the researchers recovered full 6-digit Google Authenticator codes in a significant fraction of trials across Pixel models, noting that the 2FA codes have a 30-second validity.

The article, published by Dan Goodin on 13 October 2025, highlights that Pixnapping exploits a side channel used to render pixels and that Mitigations to prevent such pixel-by-pixel data leakage remain a focus for mobile security.