CVE-2023-21036: The Acropalypse

[ColinWright]

Apparently for 5+ years the cropping / editing tools for screenshots on Google Pixel phones was only overwriting the start of the screenshot PNG file, but not truncating.

All screenshots shared for the past 5+ years might have data recoverable from them. Demo available at https://acropalypse.app/

Google still hasn't communicated anything on this.

[ytpete]

Longer threads:

https://news.ycombinator.com/item?id=35208721

https://news.ycombinator.com/item?id=35207787

[hnarn]

I don’t even know what to say. This is so bad.