Security researchers have discovered a surprising new way attackers can steal information from Android phones without even letting users know. Called Pixnapping, it can quietly read what’s shown on your screen, including two-factor codes, private messages, or location info, by “sniffing” pixels as apps draw them. A malicious app can ask another app to display specific content.
Pixnapping is a software-and-hardware trick that uses normal Android features plus a tiny timing side-channel in the phone’s graphics system. A malicious app can ask another app to show specific content (for example, open a message thread or an authenticator screen). While that content is being drawn, the attacker probes individual pixel coordinates and measures how long tiny graphics operations take. By repeating this and combining the timing data, the attacker can rebuild images on the screen, one pixel at a time, and read things like 2FA codes or message text.
Researchers from UC Berkeley, UC San Diego, Carnegie Mellon and the University of Washington tested this on high-end phones (Pixel 10, Galaxy S25 Ultra) and showed they could recover protected content from apps such as Gmail, Google Authenticator, Google Maps, Signal and Venmo. In the case of Google Authenticator, Pixnapping can extract a 2FA code in under 30 seconds while staying hidden from the user.
The flaw is tracked as CVE-2025-48561. However, Google has released a partial mitigation in the September 2025 Android security bulletin and plans to follow up with another patch. The researchers have also found some workarounds that can bypass the first fix, but Google reports no evidence so far that Pixnapping has been used in real-world attacks. Still, the report shows how even seemingly private on-screen data can be exposed in unexpected ways.
Here’s how you can stay safe.
For now, the best ways to stay safe are to keep your phone updated and install Android security patches as they arrive, avoid installing apps from unknown sources, and consider stronger 2FA options, like a physical security key or an authenticator on a separate device, for critical accounts.