Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
Three teams remotely hacked fully patched Google Pixel 10 phones at Pwn2Own Ireland contest.
Three research teams successfully demonstrated remote exploits against fully patched Google Pixel 10 devices at Pwn2Own Ireland. While contest rules require undiscovered bugs, at least two of the exploits involved previously known vulnerabilities, termed 'collisions'. Ikotas Labs won the top prize of $300,000 for chaining multiple issues, though their entry was also labeled a collision.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThree research teams successfully compromised fully patched Google Pixel 10 devices at Pwn2Own Ireland, with at least two exploits leveraging previously known but unpatched or insufficiently mitigated vulnerabilities — a phenomenon called 'collisions.' This demonstrates that being 'fully patched' does not equate to being fully secure, as vendor patch cycles can lag behind known vulnerability disclosure. Chaining multiple lower-severity bugs into a single high-impact exploit is a common real-world attacker technique that bypasses traditional patch-centric defenses. Organizations relying solely on patch status as their security benchmark are exposed to residual risk from known vulnerabilities that lack available fixes or whose patches are delayed.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.