Severe security flaw found in the Markup tool on Pixel phones

A serious vulnerability found in the Markup tool on Pixel phones can let hackers unredact and uncrop edited screenshots. Identified by security researcher Simon Aarons, the flaw is dubbed “Acropalypse” and has been assigned a CVE ID (Common Vulnerabilities and Exposures).

Suppose you shared a screenshot of your bank statement with someone and used Pixel’s Markup tool to hide sensitive information such as your bank account number or balance, the vulnerability allows anyone to unredact that confidential information, provided you sent them an original screenshot file.

Most messaging and social media apps compress and re-process shared images, in which case, the hack is not possible. For instance, Twitter is free from Acropalypse. However, Discord only started stripping screenshots of these details in January. Any marked-up Pixel screenshots shared on the platform before that are vulnerable to the hack.

Google released the Markup tool on Pixel phones with Android 9 in 2018. It lets you crop, add text, draw, and highlight screenshots. However, the vulnerability can help bad actors remove this editing and get access to the screenshot in its original state.

While Google fixed the issue with the March 2023 security update, screenshots you shared before updating your Pixels with the latest software can still be exploited, and your hidden information can be partially recovered. Aarons has devised a technical demo of the flaw, using which you can find out if your edited screenshots can be unredacted.