Pixel 10 (Product): news timeline & CVEs

Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland

Researchers collected $232,500 at Pwn2Own Ireland after 45 zero-days, including three Samsung Galaxy S26 hacks.

On day two of Pwn2Own Ireland 2026, researchers earned $232,500 by exploiting 45 unique zero-days in fully patched devices. Samsung's Galaxy S26 was compromised three times by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab. Other successful targets included the Sonos Era 300, Home Assistant Green, Philips Hue Bridge Pro, and Oracle Autonomous AI Database via multi-bug chains. Trend Micro's ZDI gives vendors 90 days to patch before public disclosure; in-the-wild exploitation was not reported.

BleepingComputerupdated Oct 8, 10:41 UTC · 13h agofirst Oct 8, 06:32 UTC · 17h agoExploit / PoC 8 sources1

How to Hack Time, With C2PA

A C2PA exclusion flaw lets a signer timestamp nothing, then change the file undetected.

David Buchanan shows that C2PA's exclusion ranges let a signer exclude an entire file, so the claim signature and RFC 3161 timestamp cover only the SHA-256 of an empty string. He timestamped a real photo, then photoshopped winning EuroMillions numbers into it after the 28 August 2026 draw without invalidating the manifest; current verifiers did not flag it. He argues that simply banning full-file exclusions is insufficient because small excluded regions can still change an image, and that the spec should define allowed exclusions per format. The write-up does not attack the timestamp authority itself and notes Google's separate on-device timestamp on the Pixel 10 was not evaluated.

Lobsters · securityOct 3, 11:58 UTC · 5d agoResearch1

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · securitySep 16, 13:24 UTC · 22d agoResearch1

Pixel 10

Timeline3 articles

Appears with

Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland

How to Hack Time, With C2PA

Forgery of C2PA on a Pixel 10