Pixnapping Attack Steals Data From Google, Samsung Android Phones

A team of researchers at Carnegie Mellon University has identified a new attack method, named Pixnapping, that can allow malicious applications to steal sensitive data from Android devices, with demonstrations against Google and Samsung phones.

According to Google, a patch for the Android OS was released, and an additional fix is in progress to protect devices against potential attacks; the CVE identifier is CVE-2025-48561, and the patch was rolled out with Android updates in September, with a further fix due in December. Researchers reported recovering data from websites such as Gmail and Google Accounts, and from apps including Venmo, Signal, Google Authenticator and Google Maps, after inducing pixel-level rendering in targeted apps.

Pixnapping can steal data visible on screen, including 2FA codes, with tests showing a 29%–73% success rate on Pixel devices for 2FA code recovery, though Samsung Galaxy S25 tests did not succeed within 30 seconds. Google told SecurityWeek it has not seen any evidence of in-the-wild exploitation. The researchers note the attack uses a GPU-side-channel technique and background operations while the victim views the malicious app, and Google is pursuing an additional fix to be rolled out later this year.