Introducing acropalypse: a serious privacy vulnerability in the Google Pixel's inbuilt screenshot editing tool, Markup, enabling partial recovery of the original, unedited image data of a cropped and/or redacted screenshot. Huge thanks to @David3141593 for his help throughout!

@ItsSimonTime @David3141593 I've got a fun one for you all to look at. I opened a 198 byte PNG with Microsoft's Snipping Tool, chose "Save As" to overwrite a different PNG file (no editing), and saves a 4,762 byte file with all that extra after the PNG IEND chunk. Sounds similar :D

@ItsSimonTime @David3141593 Snipping Tool 11.2302.4.0 Saving as a new file results in a 254 byte file with no junk past the end. So it *definitely* sounds like a failure to truncate the file.

@ProgramMax @ItsSimonTime @David3141593 print screen button + paste into mspaint, resize, save stays undefeated

@ProgramMax @ItsSimonTime @David3141593 Yeah, totally just rewriting the first section and slapping an IEND tag. The reset of the data remains intact.

@ProgramMax @ItsSimonTime @David3141593 I heard that some image types keep a thumbnail of the full image, which can be viewed, even when the shared image was cropped.

@ProgramMax @ItsSimonTime @David3141593 Was this reported before it was made public knowledge?

@ProgramMax @ItsSimonTime @David3141593 Every time there's an "oops" like this I wonder how "oops" it really was. Like how Google StreetView cars "oops"identally stored payload from WiFi back in 2010... Which is to say nothing about what they collect from everyone with "consent"... theguardian.com/technology/201…

@ProgramMax @ItsSimonTime @David3141593 Are you saying that you were able to read, from the new 198B file with its new file name being the same as an old file, the contents of the overwritten file? If so, this seems like a far more serious filesystem issue than jut a snipping tool issue.

@ProgramMax @ItsSimonTime @David3141593 I'm curious, does this bug affect Lightshot (a third-party screenshot tool)? Been using that instead of Snipping Tool :P

@ProgramMax @ItsSimonTime @David3141593 I use IrfanView to crop screenshots.

@ProgramMax @ItsSimonTime @David3141593 What is the block size on the disk drive?