VulnerabilityPublished 11 Nov 2025

What is the Pixnapping vulnerability, and how to protect your Android smartphone? | Kaspersky official blog

Source Kaspersky Security Blog

Mentioned vulnerabilities

CVE-2025-48561

Severity

Medium

Rated by Threat Radar

Data as of 4 Dec 2025, 10:23 UTC

android

What to do

AI-suggested

Ensure all Android devices are promptly updated to the latest OS version with the December 2025 security patch from Google, which aims to more effectively fix Pixnapping.
Deploy enterprise mobile device management (MDM) solutions to enforce update policies and restrict installation of untrusted or new apps with low reputation.
Educate employees to avoid installing apps from unofficial sources and to scrutinize app permissions and developer reputations, especially for new or low-download apps.
Use advanced mobile security software capable of detecting suspicious app behaviors, including unusual window overlay patterns or Intent abuse.
Limit use of sensitive apps on mobile devices where possible, or employ app-level protections such as FLAG_SECURE and custom screen obfuscation techniques to reduce exposure.
Monitor device logs and network traffic for anomalies that may indicate covert data exfiltration.
Encourage use of hardware-based multi-factor authentication tokens or biometric methods that do not rely solely on screen-displayed codes.
For high-risk users, consider restricting Android device usage or employing virtualized environments that isolate sensitive app rendering.
Collaborate with device manufacturers and Google to track patch deployment and vulnerability status.
Maintain awareness of emerging research on GPU.zip side channel mitigations and consider hardware upgrades when feasible.

Description

The Android vulnerability CVE-2025-48561 (Pixnapping) enables the theft of any data displayed on a smartphone's screen. We explain how Pixnapping works and give advice on mitigating the risk.

Impact

For European organizations, Pixnapping presents a serious threat to the confidentiality of sensitive information accessed on Android devices. Employees using vulnerable smartphones could have passwords, multi-factor authentication codes, banking details, and corporate secrets stolen silently by malicious apps without any permissions or user awareness. This could lead to unauthorized access to corporate networks, financial fraud, identity theft, and compromise of critical business systems. The attack’s stealthy nature and lack of required permissions make detection difficult, increasing the risk of prolonged undetected breaches. Organizations relying heavily on Android devices for secure communications, remote access, or mobile banking are particularly at risk. The potential for credential theft could undermine multi-factor authentication protections, weakening overall security posture. Additionally, the inability to fully mitigate the GPU.zip side channel at the hardware level means the vulnerability may persist even after software patches, requiring ongoing vigilance. The attack could also facilitate espionage or targeted attacks against high-value individuals or sectors within Europe, such as finance, government, and critical infrastructure. Although no active exploits are reported, the demonstrated feasibility and short time to extract sensitive data (e.g., 22 seconds for a 6-digit code) underscore the urgency of addressing this threat.

Summary

Pixnapping is a sophisticated Android vulnerability (CVE-2025-48561) discovered by researchers that enables an attacker to capture screen content from other apps without requiring any special permissions. The attack exploits fundamental Android features: the ability to send Intents to launch or manipulate apps and to render app windows. The malicious app sends a crafted Intent to a target app, forcing it to render sensitive information in a hidden window that is not visible to the user. The attacker then overlays this hidden window with multiple translucent windows, each designed to blur and isolate specific pixels. Because Android only allows apps to read pixels from their own windows, the attacker uses a combination of a mostly opaque window with a single transparent pixel and a magnifying blurred window on top to isolate individual pixels from the victim app’s content. To decode the pixel values, the attacker leverages a GPU timing side channel vulnerability known as GPU.zip, which measures the time taken to compress image data sent from the CPU to the GPU. This timing varies depending on the pixel data, allowing the attacker to infer the pixel color values. By repeating this process hundreds of times, the attacker reconstructs meaningful screen content such as one-time authentication codes, passwords, and financial data. The attack was demonstrated on Android versions 13 to 16 on Google Pixel 6–9 and Samsung Galaxy S25 devices, and is believed to affect all modern Android smartphones due to reliance on standard Android and GPU mechanisms. Android’s existing protections—such as FLAG_SECURE, media projection restrictions, and app sandboxing—are bypassed because the attack requires no special permissions and uses only basic Android capabilities. Google issued a patch in September 2025, but it was insufficient and quickly bypassed; a more robust fix is planned for December 2025. Currently, no active exploitation in the wild is known, but the vulnerability poses a significant risk if weaponized. Users are advised to keep devices updated, avoid installing untrusted apps, and use comprehensive mobile security solutions.

References

kaspersky.com/blog/pixnapping-cve-2025-48561/54756/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 2 Dec 2025, 21:51 UTC

References

Community reviews

Related threats