Google Authenticator No Longer Enough: Pixnapping Exploit Puts Two-Factor Security at Risk

In August 2026, Google's security team acknowledged that using only Google Authenticator for two-factor authentication is no longer sufficient due to a side-channel attack called Pixnapping. This exploit can capture live Authenticator codes on Android screens in under 30 seconds with a reported 29-73% success rate.

The issue lies not within the Authenticator app itself but rather in the platform it runs on and the surrounding ecosystem. Researchers disclosed the vulnerability, tracked as CVE-2025-48561, which affects Android 13 through 16 devices, including Pixel 6 through Pixel 9 and the Samsung Galaxy S25.

Google has since implemented a partial fix in its September 2025 Android security update, but researchers found a bypass. A hardware security key is now recommended to provide an additional layer of protection against phishing and screen-scraping exploits.