With the release of Android 9.0 Pie in 2018, Pixel phones added a built-in screenshot editor called ‘Markup’. A tool pops up every time you take a screenshot, tapping the app’s pen icon gives you access to tools like cropping and several colored drawing pens. This is very useful assuming that Google’s markup tools actually work that way, but a new vulnerability points out that the edits made by this tool weren’t actually destructive. You can crop or unedit Pixel screenshots taken in the last four years.
The bug was discovered by Simon Aarons It is called “Acropalypse”, more formally CVE-2023-21036. acropalypse.app has a proof-of-concept app that can undo a Pixel screenshot, and it works. There’s also an excellent technical article here by Aarons collaborator David Buchanan. The basic gist of the problem is that Google’s screenshot editor overwrites the original screenshot file with the newly edited screenshot, but it never truncates or recompresses the file. If your edited screenshot has a smaller file size than the original (very easy with the cropping tool), it will be his PNG with tons of junk data hidden at the end. That junk data consists of the last bits of the original screenshot, and it’s actually possible to recover that data.
It seems like a bad way to write a screenshot cropping tool, but in Google’s defense, the Android 9 release of the markup tool worked correctly and truncated overwritten files. However, Android 10 has made many dramatic “scoped storage” changes to how file storage works on Android. It’s unclear how or why this happened, but perhaps as part of a huge wave of file handling commits, one undocumented change was made to the Android framework file parser: framework ‘write’ mode now stops truncating overwritten files, creating a markup bug. The markup tool relies on the OS’s handling of files, and the way it works has changed in later releases, but no one seems to have noticed.
Ron Amadeo
The acropalypse.app proof-of-concept tool works well. If you have an unpatched Pixel device lying around, crop the screenshot and feed it into the tool, which will return the uncropped data. This is not perfect. It usually returns a badly corrupted PNG with large blank spaces and strips of funky colors, but it can fairly reliably restore the bottom of a cropped image. The bug was fixed in his March 2023 security update for Pixel devices and was marked as a “high” security vulnerability. This only affected the Pixel screenshot editor which overwrites and saves a PNG, not the Google Photos editor which makes a new copy and saves a JPG. So generally unless you’re doing something weird like taking a screenshot of the camera output, the cropped screenshot is fragile and not a cropped camera photo.
However, just patching the bug for future users won’t solve the problem. The problem with screenshots of his Pixel from the last 4 years is still there, likely filled with hidden data that people weren’t aware they were sharing. If you share that screenshot publicly, whether that screenshot leaks data depends on who hosts it. Some apps, such as Twitter, recompress uploaded files and remove hidden data in screenshots. Third parties may uncrop the screenshot if the app shares the original file instead. Discord, in particular, has been confirmed to do this, and many other messaging apps probably share the original file as well.
