Vulnerabilities
Researchers Remotely Hack Fully Patched Google Pixel 10 at Pwn2Own
Three teams demonstrated remote hacks of the latest Google Pixel 10 at the Pwn2Own contest, despite the phones being fully up to date. The details of the exploits have not yet been published.
Ross GrantUpdated 3 min read
The short version
At a major hacking contest, three teams managed to break into the latest Google Pixel 10 phone, even though it had all the latest security updates. The contest pays researchers to find and report these flaws so companies can fix them. Details of how the hacks worked are not public yet, and there is nothing Pixel users need to do right now.
By the numbers
- $300,000top prize for a single Pixel 10 exploitThe Hacker News
- $1.2 milliontotal prize money awarded at Pwn2Own Ireland 2026The Hacker News
- 3Pixel 10 remote exploits demonstratedThe Hacker News
- 90 daysmaximum time for Google to patch before details are publishedThe Hacker News
What happened?
Three research teams remotely hacked fully patched Google Pixel 10 phones at the Pwn2Own contest in Ireland on 8 October 2026. The contest requires devices to be up to date and pays researchers for working exploits, which are then reported to vendors. Details of the exploits have not yet been published. [The Hacker News]
What is Pwn2Own and what happened this year?
Pwn2Own is a well-known hacking contest where security researchers try to break into popular devices and software. The rules require all targets to be fully patched, meaning they have the latest security updates. If a researcher can show a working exploit, they win a cash prize and the details are passed to the vendor to fix the flaw.
At the 2026 Pwn2Own event in Cork, Ireland, three research teams managed to remotely hack Google's Pixel 10 phone. The Pixel 10s used in the contest were fully up to date, with Google's latest October security bulletin released just two days before the event. The contest organiser, Trend Micro's Zero Day Initiative (ZDI), confirmed the results but has not yet published technical details of the exploits. The Hacker News (opens in a new tab)
How did the attacks work?
All three successful entries were remote exploits. This means the researchers broke into the phones either through web content opened in the default browser or over wireless connections such as NFC, Wi-Fi, Bluetooth or baseband (the phone's radio). To win, a team had to run their own code on the phone or extract sensitive data. The exact method each team used, and what they accessed, has not been revealed yet.
Some of the attacks used what the contest calls a "collision", a bug already known to the organiser or the vendor, but not yet fixed. Entries using a collision can still win, but may get a lower prize. One team, Ikotas Labs, won the full $300,000 top prize for their Pixel 10 exploit, even though their entry was labelled a collision. The reasons for this have not been explained.
What does this mean for Pixel users?
The contest shows that even fully patched devices can have unknown vulnerabilities. However, the exploits are not public, and the contest hands the details to Google so they can fix the bugs. There is no immediate action for Pixel users to take. ZDI gives vendors 90 days to release a patch before publishing technical details. Google's October Pixel security bulletin did not mention these new exploits.
Other devices targeted at Pwn2Own
The Pixel 10 was not the only device hacked at the contest. Samsung's Galaxy S26 was exploited in all seven attempts, and researchers also broke into smart home devices, printers and a wellness device. In total, 51 out of 63 scheduled attempts succeeded, and more than $1.2 million in prizes were awarded over three days.
What happens next?
Google now has up to 90 days to patch the vulnerabilities before details are made public. Until then, the technical specifics remain confidential. This process is designed to protect users while vendors prepare fixes. The event highlights the ongoing challenge of securing even the most up-to-date devices against skilled researchers.
Claimed vs confirmed
- Confirmed
Three teams remotely hacked fully patched Google Pixel 10 phones at Pwn2Own.
Pwn2Own organiser ZDI and The Hacker News reported the successful exploits.
- Confirmed
One exploit used a bug already known to the vendor or organiser (collision).
ZDI labelled some entries as collisions, meaning they used already-known bugs.
- Denied
The full technical details of the exploits are public.
ZDI has not yet published the technical details of the exploits.
The impact
- Money
- Google could face costs for patching and possible regulatory scrutiny. Under GDPR, fines can reach €20 million or 4% of global turnover if user data is at risk.
- Reputation
- The event may affect trust in Pixel device security, but the responsible disclosure process helps limit damage.
- Customers
- There is no evidence of real-world attacks. Pixel users do not need to take action until Google releases further guidance.
Why it matters
This shows that even the newest, fully updated devices can have unknown security flaws. The contest process helps companies fix these issues before they become public, but it is a reminder that no device is completely secure.
How does it work?
The attacks were remote exploits, meaning the researchers broke into the Pixel 10 through web content or wireless connections (NFC, Wi-Fi, Bluetooth, or baseband). The exact technical details have not been published yet.
Key points
- Three teams remotely hacked fully patched Google Pixel 10 phones at Pwn2Own.
- The details of the exploits are not yet public and have been reported to Google.
- Remote exploits can work even on fully updated devices.
- Vendors have 90 days to patch before details are published.
- No immediate action is needed for Pixel users.
Sources
The Hacker News
Reference
