Pixnapping Android vulnerability lets malicious apps infer on‑screen pixels to reconstruct secrets such as crypto wallet recovery phrases and 2FA codes by overlaying semi‑transparent activities and timing renders, exposing users