Three Teams Exploit Fully Patched Google Pixel 10 at Pwn2Own Ireland
Researchers demonstrated remote zero-click exploits on the latest Google smartphone at a major hacking contest in Cork, Ireland, on October 8.
Key points
- Three distinct research teams successfully compromised the Google Pixel 10 during Pwn2Own Ireland.
- The contest rules mandated that all target devices be fully patched, highlighting zero-day vulnerabilities.
- Ikotas Labs won the overall contest and the top prize of $300,000 for one of the Pixel exploits.
Three research teams demonstrated successful remote compromises of the fully patched Google Pixel 10 during the Pwn2Own Ireland hacking contest on October 8. The event, held in Cork, Ireland, serves as a rigorous testbed for identifying zero-day vulnerabilities in widely used consumer technology.
The competition rules strictly required that all target devices, including the Pixel 10, be updated to the latest available software versions prior to the attack attempts. This ensures that any successful breach represents a previously unknown vulnerability that vendors have not yet addressed. According to The Hacker News, the contest structure incentivizes researchers to develop working exploits, which are then passed to the respective vendors for remediation. One of the three successful attacks against the Pixel 10 was executed by Ikotas Labs. This specific exploit earned the team the contest’s top prize of $300,000 and secured their position as the overall winner of the event.
Contest Mechanics and Vendor Response
Pwn2Own is a series of hacking competitions organized by the Zero Day Initiative, a division of Trend Micro. The program operates on a bug bounty model where security researchers are paid for demonstrating functional exploits against specific software and hardware targets. When a team successfully breaks into a device, they must provide proof of concept and detailed technical information to the vendor.
This process allows companies like Google to understand the nature of the flaw and develop patches before the vulnerabilities can be weaponized by malicious actors in the wild. The fact that three separate teams managed to breach the same device model underscores the complexity of mobile security and the persistent demand for advanced exploit development techniques.
Implications for Mobile Security
The successful exploitation of the Pixel 10, Google’s latest flagship smartphone, raises significant concerns for mobile security professionals. The device represents the current state of the art in Android security, including hardware-enforced protections and regular software updates. The ability of multiple teams to bypass these defenses remotely suggests that sophisticated threat actors may possess similar capabilities.
While the vulnerabilities demonstrated at Pwn2Own are currently contained within the contest environment, the existence of these zero-days indicates a potential risk vector for high-value targets. The rapid succession of successful attacks highlights the ongoing arms race between security researchers and exploit developers.
What should you do?
Security teams should monitor official security advisories from Google for updates regarding the Pixel 10 and other Android devices. Organizations should enforce strict device management policies to ensure all mobile endpoints receive software updates as soon as they are released. Users should be educated on the risks associated with interacting with unknown links or attachments, although remote exploits may not require user interaction.
What to do and how to stay safe: Google Pixel 10
- Ensure all mobile devices are updated to the latest available operating system version immediately upon release.
- Monitor vendor security bulletins for patches related to the specific vulnerabilities demonstrated in this contest.
- Restrict the installation of unverified applications and enforce strict mobile device management policies.
- Watch for unusual device behavior or unexpected network traffic that may indicate a compromise.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What device was compromised at Pwn2Own Ireland?
The Google Pixel 10 was successfully compromised by three different research teams.
Were the devices patched before the attacks?
Yes, the contest rules required all target devices to be fully patched before the hacking attempts began.
Who won the top prize at the contest?
Ikotas Labs won the overall contest and the $300,000 top prize for one of the Pixel 10 exploits.
