Two (2) security researchers have published a proof-of-concept (PoC) exploit for a critical API design vulnerability affecting Google Pixel devices. The flaw exists in the Android 9 Pie Markup utility which allows users to crop, edit, and redact images and screenshots. In the PoC published on Twitter, the Markup’s Pen tool is used to redact the card number from an image of a credit card, which is then exploited to partially recover the original image, clearly displaying the card number. A technical article from the 9to5Google website states that when an “image is cropped using Markup, it saves the edited version in the same file location as the original. However, it does not erase the original file before writing the new one. If the new file is smaller, the trailing portion of the original file is left behind, after the new file is supposed to have ended.” The flaw, tracked as CVE-2023-21036, has been coined “Acropalypse”, and successful exploitation could allow approximately 80% of an edited screenshot to be recovered. This poses a great threat to Pixel users who may use the Markup utility to protect sensitive information, as well as their own identity and the identity of others. Along with the PoC exploit, the researchers have offered a free demo utility which allows Pixel users to test the exploit on their own redacted and cropped images. The flaw was first reported to Google in January 2023, and on March 13, 2023, the vulnerability was patched. It should be noted that although the patch defends new image edits, it will not protect edited screenshots from the past five (5) years. One of the researchers stated that he wrote a script to scrape his own message history and found many images he’d sent over the years were vulnerable to exploitation. CTIX analysts recommend that all Google Pixel users should ensure that they are running the latest secure version of Android 9 to prevent exploitation of future images. There is currently no answer on providing a solution that patches images that have already been taken. CTIX will monitor this matter and provide relevant updates if a solution is identified.