Pixnapping flaw on Android: With zero permissions, it can steal 2FA codes and data, here is what you need to do

Think your Android phone is safe? A new security vulnerability discovered by researchers has led to putting modern Android smartphones at risk from deadly malicious cyberattacks. Dubbed ‘Pixnapping,’ the sophisticated attack allows a malicious and less-privileged app to steal highly sensitive information displayed on a user’s screen. Note that the ‘stealable’ information included two-factor authentication (2FA) codes, private messages, and location timelines.

The security flaw, tracked as CVE-2025-48561, is claimed to affect all modern Android handsets, posing a severe risk even to high-end and recently launched devices like the Google Pixel 10 and the Samsung Galaxy S25 Ultra.

The researchers, who hail from institutions including UC Berkeley, UC San Diego, Carnegie Mellon, and the Uni