Now that we know this genre of vulnerability affects multiple cropping tools, it makes you wonder what other image-capturing features also suffer from a similar flaw. The Acropalypse: A Dark Day for User Privacy

Last month, whistleblowers were warned that there are multiple ways to uncover the original version of a cropped image within Google Docs.Įven if a user doesn't have edit permission, pressing copy on the image and then pasting it into another Google Doc will allow anyone to reset the image to its original size. This isn't the only time that this sort of vulnerability has cropped up in recent months. However, Google was made aware of the vulnerability in January 2023, and a patch was rolled out on March 13. In theory, any cropped image sent in that time period could be partially reset. Worryingly, this news comes shortly after a similar flaw was revealed in Google Pixel Phones, which has been exploitable for around five years. Cropping with a Google Pixel – and in Google Docs – is Also Risky However, unused data that corresponds to cropped parts of images remains attached, allowing anyone with a Hex editor to recover it. PNG file signatures always finish with an “IEND” chunk at the end – data appearing after this is ignored by image viewers displaying the image. Wonder about the world that you live in /g19MTxlzN1 Compare file sizes of cropped and originalĦ. Vulnerabilities researcher Will Doormann shows how you can confirm this on Twitter:ĥ. Instead of simply deleting or removing the parts of the image a given user has cropped, Windows just leaves the unused data behind – which explains why images cropped with the Window snipping tool often appear to be the same size as uncropped originals. This week, security researchers have shown that Windows 11 tools for screenshotting and cropping images retain a lot of the original image data, allowing any recipient of such a photo to regenerate significant portions of the initial image.

Snipping tool with text box