In short: Google’s Pixel 10 was successfully attacked three times on October 8, 2026, during Pwn2Own Ireland in Cork, even though contest rules require targets to run the latest fully patched software. The three teams earned a combined $562,500. Most of the bugs used were “collisions” (already known to the vendor or organizer), and only one entry included a true zero-day, so this was not three brand-new attack chains.
The three successful Pixel 10 entries
| Team | Result | Payout |
|---|---|---|
| Xint (Tim Becker and Yves Bieri) | Single bug, ruled a collision | $150,000 |
| Ikotas Labs | Chain of several issues, labeled a collision | $300,000 |
| Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara | Two-bug chain: one collision plus one zero-day | $112,500 |
A fourth remote attempt, by White Noise Club on day one, ran out of time before the exploit worked, so three of four Pixel 10 attempts succeeded.
What “remote” means here
Under Pwn2Own rules, a remote mobile attack can arrive through web content in the default browser or through NFC, Wi-Fi, Bluetooth or the cellular baseband. The Zero Day Initiative (ZDI), which runs the contest, has not said which route each team used. So “remote” does not automatically mean zero-click: some of these chains may have needed the victim to open a page.
Why collisions matter
A collision means the bug was already known to the vendor or ZDI before the demo. Collisions still earn money and points, but less than original research. For Pixel owners, this is partly good news: some of the issues may already be on Google’s fix list. It also shows that “known” is not the same as “patched”, since the phones were running the newest available build.
The bigger picture at Pwn2Own Ireland 2026
- The event ran from October 6 to 9, 2026, with total awards above $1.2 million.
- 51 of 63 scheduled attempts succeeded, and every product on the schedule was exploited at least once.
- Ikotas Labs won Master of Pwn with four wins, $361,000 and 42.5 points, including entries against AI products.
- Samsung’s Galaxy S26 fell in all seven attempts against it.
- Printers from Lexmark, Canon and Brother, plus smart-home devices like the Sonos Era 300, Philips Hue Bridge Pro and Home Assistant Green, were also compromised.
- No attempts were registered against the iPhone 17 or WhatsApp.
What Pixel owners should do
There is nothing to patch yet for these specific bugs. Google’s October Pixel bulletin came out on October 6, two days before the contest, and does not cover them. Winning researchers hand their exploits to ZDI, which reports them to Google; vendors normally get 90 days before full details are published, which points to around early January 2027.
- Install Pixel updates as soon as they arrive and watch the November and December bulletins.
- Make sure you have the September 2026 update (patch level 2026-09-05 or later), which fixed a modem flaw, CVE-2026-58704, that Google said may be under limited, targeted exploitation.
- Turn off Wi-Fi, Bluetooth and NFC when you don’t need them to reduce remote attack surface.