Google ‘acropalypse’ lets users see hidden parts of images
The exploit allows people to recover hidden parts of an image that have been cropped out
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.Google Pixel owners may have their private information exposed after researchers discovered a security flaw with the phone’s picture editing feature.
Dubbed the ‘acropalypse’, the vulnerability allows people to recover hidden parts of an image that have been cropped out by Pixel phone users.
Cropped screenshots could contain anything from credit card numbers to private photos, experts warn.
Google has since fixed the problem but any photo edited through the Markup tool prior to the patch being issued is still at risk of being reverse edited.
Engineers Simon Aarons and David Buchanan warned that the issue first emerged around five years when Google released the Android 9 Pie mobile operating system.
Photos shared on social media could be vulnerable to the exploit, with an example given of a cropped image of a credit card shared to Discord that had been cropped and edited using Google Pixel’s Markup tool.
Using the trick, the engineers were able to uncrop and reveal the credit card’s number.
Mr Aaronds shared their findings of the bug in a detailed blog post.
The pair described it as “a serious privacy vulnerability in the Google Pixel’s inbuilt screenshot editing tool Markup” that allows “partial recovery of the original, unedited image data of a cropped and/or redacted screenshot”.
Mr Buchanan revealed that his own data is at risk through the vulnerability, having owned a Google Pixel 3XL and used Discord.
“The worst instance was when I posted a cropped screenshot of an eBay order confirmation email, showing the product I’d just bought,” he wrote.
“Through the exploit, I was able to un-crop that screenshot, revealing my full postal address (which was also present in the email). That’s pretty bad!”
The Independent has contacted Google for more information on which phones and Pixel users may still be at risk.
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments