On-screen data disclosure via cross-window blur timing

Side-channel information disclosure in Google Android 13 through 16 allows local users to read on-screen data through rendering timing. SurfaceFlinger accepts excessive cross-window blur requests, letting a malicious app force victim pixels through the rendering pipeline and distinguish their colors from GPU compression timing. A locally installed app needs no special Android permission or user interaction and can reconstruct messages or one-time codes, but exploitation depends on device-specific graphics behavior.