Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
Summary: Three research teams broke into fully patched Google Pixel 10 phones on October 8 at Pwn2Own Ireland in Cork, with Ikotas Labs taking the top $300,000 prize and the overall win. The three Pixel 10 entries paid $562,500 combined, all were registered as remote exploits, and ZDI had not published how any of them work as of October 9.
Bottom line: At least two of the three Pixel 10 wins used a bug already known before the attempt, which ZDI calls a collision, and Ikotas Labs received the full $300,000 despite its entry carrying that label with no explanation - so a phone Google shipped as fully patched fell to flaws that were already on the board.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-58704
- Related
- CVE-2026-58704: Google Pixel Improper Authorization Vulnerability Known Exploited Vulnerabilities · Sep 16, 2026