"Pixnapping" vulnerability lets Android apps steal 2FA codes in 30 seconds

Google tried to mitigate bug, but researchers worked around fix.

Source