Keeping a smartphone updated wasn't enough to stop researchers from hacking Google's Pixel 10 at Pwn2Own Ireland. Three separate teams successfully exploited the fully patched device remotely on Oct. 8.
The demonstrations involved different vulnerabilities, including a zero-day and flaws already known to competition organizers or vendors. Although the attacks took place under controlled conditions, they exposed weaknesses that existing security updates had not addressed.
For organizations relying on Android smartphones to access corporate email, cloud applications, and authentication services, the findings highlight why mobile security requires more than regular patching.
Three teams collect $562,500 for Pixel 10 hacks
At the contest in Cork, Ireland, Trend Micro's Zero Day Initiative (ZDI) confirmed three successful Pixel 10 remote exploits. ZDI published the following results on Oct. 8:
Research team | Exploit demonstrated | Award |
| Xint: Tim Becker and Yves Bieri | One bug collision | $150,000 |
| Ikotas Labs | Multiple issues chained together, labeled a collision | $300,000 |
| Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara | Two-bug chain: one collision and one zero-day | $112,500 |
Ikotas Labs' $300,000 win also helped it secure the Master of Pwn title. All three successful Pixel demonstrations involved bug collisions, but the third team also used a zero-day. The results do not mean researchers uncovered three completely new vulnerabilities.
What the exploits reveal about existing patches
A bug collision means an exploit overlaps with a vulnerability already known to the organizer or vendor; it does not necessarily mean a fix was available. The contest rules require targets to run the latest fully patched operating system and permit remote attacks through default-browser web content or NFC, Wi-Fi, Bluetooth, or baseband communications. ZDI’s results do not identify which methods the Pixel teams used, so “remote” should not be interpreted as confirmation of a zero-click attack.
Google published its October Pixel Update Bulletin on Oct. 6, two days before the demonstrations. ZDI’s day-three results do not identify the affected components, CVEs, or associated fixes. Successful researchers must provide their exploits and technical documentation to ZDI for disclosure to affected vendors. The demonstrations do not establish that criminals are using the same exploits against Pixel 10 owners.
What security teams should check while awaiting patches
Business smartphones can provide access to corporate email, active cloud sessions, and authentication credentials. COE Security said that the consequences of a compromised device depend on its permissions and the services it can access, not just the handset itself.
With the technical details of the Pixel 10 exploits still undisclosed, organizations have limited information about the specific weaknesses researchers used. Security teams can still strengthen their mobile defenses by focusing on three practical measures:
- Review device security. Inventory corporate and BYOD phones, verify updates, and enforce mobile device management requirements.
- Limit sensitive access. Use conditional access and least-privilege policies, and make sure work sessions can be revoked if a phone is compromised.
- Prepare for disclosures. Follow Google and ZDI advisories, and establish procedures to isolate affected devices and roll out fixes as they become available.
These measures are general security precautions, not confirmed mitigations for the specific contest exploits. For organizations managing Android devices, the takeaway is to combine patching with control over business access. An updated phone should still be subject to device policies, access restrictions, and incident-response procedures. Those controls give administrators options to contain potential exposure while they assess future disclosures and confirmed fixes.
Related reading: The Pixel 10 wasn't the only Android flagship targeted at Pwn2Own Ireland. Samsung's Galaxy S26 was hacked seven times during the same competition, raising similar concerns about known vulnerabilities and the limits of security updates.