In 2023, security researchers Simon Aarons and David Buchanan disclosed a file-handling vulnerability known as aCropalypse (CVE-2023-21036) in Markup, the screenshot editor introduced on Google Pixel phones with Android Pie in 2018. When a user cropped or edited an image and saved it over the original, Markup failed to properly truncate the file. Residual compressed data could therefore preserve much of the uncropped screenshot, potentially exposing private images, credit-card numbers, or other information that users believed they had removed. The issue had also been submitted to Google’s issue tracker by Lucy Phipps on August 11, 2022.
Google finalized an internal patch on January 24, 2023, but the public fix began rolling out in the March 13, 2023 security update; Pixel 3 and 3a, Pixel 4, Pixel 5, Pixel 6, and Pixel 6a devices running affected Android 10-era software were vulnerable until updated. Discord mitigated the risk on January 17, 2023, while image-processing services such as Cloudflare added checks against malformed residual data. On March 21, 2023, Chris Blume identified similar file-size behavior in Microsoft’s Windows 11 Snipping Tool, and Buchanan confirmed that tool and Windows 10 Snip & Sketch were also susceptible, though the older Win32 Snipping Tool was not.
