A group of researchers from four American universities developed a Pixnapping attack technique (CVE-2025-48561) that allows unprivileged users to Android- applications that don't request additional permissions can determine the content displayed by other applications. As a practical example of the attack's application, the detection of two-factor authentication codes displayed by the Google Authenticator app is demonstrated. It is also shown how the attack can be used to extract sensitive data displayed when using Gmail, Signal, Venmo, and Google Maps.
To determine the screen content, a pixel-by-pixel analysis method was used, first described in 2013 and implemented in 2023 by the same team of researchers in the GPU.zip side-channel attack. The method's essence is that, due to optimizations in the GPU, rendering a pixel with a color that matches an already displayed color is faster than rendering a pixel with a different color. By assessing the difference in pixel rendering time, it is possible to recreate the existing screen content and create a semblance of a screenshot.
A Pixnapping attack involves launching a target application, overlaying its own window, and pixel-by-pixel searching of its contents, analyzing the execution time of graphical operations on each pixel. This search allows one to determine with a high degree of certainty which pixels have a white background and which are used to display characters. To conceal pixel manipulations from the user, masked layers are applied; during the attack, the contents of the application window from which the attack is performed continue to be visually displayed on the screen.
To activate the attacked application and get pixels from its window into the rendering pipeline, switching between Android-activities using intent requests. Translucent windows are displayed over the targeted application's window, highlighting individual pixels and initiating graphical operations on them using the Window Blurs API. Callbacks linked to VSync are used to measure the exact pixel rendering time.
A limitation of the previously proposed GPU.zip method was low performance. When attacking a browser, determining the username under which a user logged into Wikipedia in another tab took 30 minutes on an AMD Ryzen 7 4800U GPU and 215 minutes on an Intel i7-8700 GPU, with an accuracy of 97-98%. To meet the 30-second code refresh interval in Google Authenticator, the method was improved and optimized. The number of checks per pixel was reduced from 64 to 16, and the delay between pixel processing was reduced from 1.5 seconds to 70 milliseconds. Scanning was performed not on the entire screen, but only on the area where Google Authenticator displays the code.
The method was tested on Pixel 6, 7, 8 and 9 smartphones with versions Android 13-16 to detect one hundred six-digit two-factor authentication codes generated in Google Authenticator. The accuracy of code detection on the tested smartphones was 73%, 53%, 29%, and 53%, while the detection time was 14.3, 25.8, 24.9, and 25.3 seconds, respectively. On the Samsung Galaxy S25 smartphone, the researchers were unable to meet the 30-second time limit due to noise introduced by other applications, but the device demonstrated attack variants on other applications for which there was no time limit. The mechanisms used in the attack are not specific to individual smartphone models, and the attack potentially affects any Android-devices.
Google added vulnerabilities in its September patches Android initial protection from attack, based on disabling the blur operation on a large number of layers. In response, researchers found a way to bypass this restriction, so Google plans to implement more comprehensive protection in the December update. AndroidGPU manufacturers have not yet announced any plans to patch the leak, despite the attack method having been known for over 12 years.
Source: opennet.ru
