Three Remote Attacks on Pixel 10 Succeed at Pwn2Own Ireland
Three teams at Pwn2Own Ireland successfully compromised fully updated Google Pixel 10 devices remotely. ZDI has not yet released technical details or a timeline for fixes.
Pwn2Own Pixel 10 brought three successful demonstrations of remotely compromising the device on the third day of the competition in Cork, Ireland. Organizer Zero Day Initiative (ZDI) confirmed that the attacks were carried out by the Xint and Ikotas Labs teams, as well as the trio of Dimitrios Valsamaras, Ken Gannon and Tenie Valsamara.
The participants received a combined $562,500 for the three successful attempts. The highest individual award, $300,000, went to Ikotas Labs, which also earned the title of Master of Pwn. Xint received $150,000, while the Valsamaras, Gannon and Valsamara trio received $112,500.
Pwn2Own Pixel 10 Ran with Current Patches
Under Pwn2Own rules, competition targets run the latest available fully patched version of the operating system and use the default configuration. The result therefore does not indicate an attack against specific users, but a verified demonstration of an exploitable remote attack surface on a currently patched Pixel 10 under controlled competition conditions.
For the Pixel 10 Remote category, the rules allow attacks through web content in the default browser, NFC, Wi‑Fi, Bluetooth or baseband. ZDI has not disclosed which of these vectors the individual teams used. It is also not publicly known which vulnerabilities were part of the chains, what impact they had on data or device privileges, or whether they required user interaction.
What the Competition Results Mean
Pwn2Own is a competition focused on the coordinated disclosure of security flaws to vendors. Technical information about successful attempts is typically not released immediately, giving the affected supplier time to prepare fixes. In this case, ZDI has not yet confirmed which flaws Google will fix or in which security bulletin they may appear.
Two result entries were marked “collision.” This designation means that the chain contained a previously known flaw. ZDI did not explain why Ikotas Labs nevertheless received the full $300,000 award.
There is also no confirmation that the vulnerabilities demonstrated during the competition are actively being exploited outside the competition devices. Pixel users therefore do not currently have specific public indicators of compromise or announced mitigations for these flaws.
What to Expect Next
Further details may come from Google’s security bulletins, assigned CVE identifiers or later technical materials from ZDI after the coordinated disclosure period. Any statement from Google about the scope of affected models and the availability of fixes will also be important.
Until fixes are released, the practical step is to keep Android and the device’s security updates on the latest available version. The Pwn2Own Pixel 10 results alone do not yet provide enough information to determine the specific risk for ordinary deployments.
Sources
- Zero Day Initiative — Pwn2Own Ireland 2026: Day Three Results & Master of Pwn – Officially confirms three successful remote attempts against Pixel 10, the teams, awards and Ikotas Labs’ victory.
- Zero Day Initiative — Pwn2Own Ireland 2026 Rules – Defines the fully patched targets, successful-attack conditions and permitted remote vectors for Pixel 10.
- The Hacker News – Independently summarizes the results and notes that technical details and a fix have not yet been released.
Verified and updated: 10/10/2026 06:27
