Markup, the default tool for editing screenshots on the Google Pixel, has a security flaw that lets images become partially “unedited.” This could reveal personal information that users had tried to hide. 9to5Google and Android Police found this earlier.
The flaw, which was found by reverse engineers Simon Aaarons and David Buchanan, has since been fixed by Google, but the edited screenshots shared before the update still have a lot of effects.
As Aaarons explained in a Twitter thread, the “aCropalypse” flaw lets people partially recover PNG screenshots edited in Markup. That includes situations where someone may have used the tool to crop or scribble out their name, address, credit card number, or any other personal information the screenshot may contain.
An evil person could exploit this weakness to undo some of these changes and get information users thought they had hidden.
Unlock the Secrets of Hillsboro – Find Its Zip Codes with Your Google Pixel.
In an upcoming FAQ page that 9to5Google got early, Aarons and Buchanan explain that this flaw exists because Markup saves the original screenshot in the exact file location as the edited screenshot and never deletes the original version.
If the edited version of the screenshot is smaller than the original, “the end of the original file is left behind after the end of the new file.”
Buchanan says “This bug is a bad one. You can patch it, but you can’t easily un-share all the vulnerable images you may have sent. The bug existed for about 5 years before being patched, which is mind-blowing given how easy it is to spot when you look closely at an output file”.
The FAQ page says that some sites, like Twitter, reprocess the images posted on their platforms and remove the flaw, but others, like Discord, don’t.
In a recent update on January 17, Discord fixed the bug. This means edited images shared on the platform before that date may be at risk. It’s still unclear if any other sites or apps were affected, and if so, which ones.
Join Our Twitter Community for the Latest and Greatest