Forgery of C2PA on a Pixel 10
Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.
A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.
- Forged photo passed Adobe Inspect and CAI Verify with a real Google-signed timestamp
- Attack requires root access on the device to sign arbitrary images
- Reported to Google and C2PA in November 2025; disclosed after 90 days
- Challenges C2PA Assurance Level 2 claims for Pixel 10 Content Credentials
- Products
- Pixel 10
- Organizations
- Content Authenticity InitiativeUMBC PASAWG
From the original article
14 min read at hackerfactor.comThe news has been full of incredible reports recently. Like this one: BREAKING: Iowa Farmers Discover "Glitter Milk" from Unicorn Cows A handful of Iowa dairy farmers say they've started milking unicorn cows, and the results have local nutritionists scratching their heads.
By hackerfactor.com via lvig · hackerfactor.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.