Pwn2Own Ireland 2026: Researchers Remotely Crack the Pixel 10 Three Times
Three research teams demonstrated remote exploits against a fully patched Google Pixel 10, earning more than $560,000 combined. It made Android the star of a competition that paid out over $1.2 million across 98 distinct zero-days.
Pwn2Own Ireland 2026 has concluded, and the most expensive prize went to one phone. According to the competition's final leaderboard, researchers collected a combined $1,262,000 across 98 unique zero-day vulnerabilities from 29 research teams, and the largest single category was the Google Pixel 10. Three teams each demonstrated a remote exploit, together earning more than $560,000.
Three teams, one phone, big money
The Pixel 10 rewards went to three distinct entries. Tim Becker and Yves Bieri of Xint delivered a single-vulnerability collision that paid $150,000. Ikotas Labs earned the competition's top reward, $300,000 and 30 Master of Pwn points, after chaining multiple flaws together to take over the device. A third entry from CENSUS Labs and Mobile Hacking Lab researchers used a two-bug chain for $112,500. All three were registered as remote exploits.
The competition's rules set the bar: a winning entry must run the attacker's own code on the phone or pull sensitive data from it, achieved by opening web content in the device's default browser or through one of four radio links — NFC, Wi-Fi, Bluetooth, or baseband. Because the Pixel 10 was fully patched, each entry had to string together flaws that no single security update could eliminate on its own, a harder and more valuable bar than triggering a lone bug.
Why an Android flagship led the leaderboard
The Pixel 10 was not the only target. Payouts also covered printers, smart speakers, smart home hubs, a wellness device, AI infrastructure and coding tools, and cloud databases — including a Lexmark CX532adwe printer brought down by a two-bug chain. The Samsung Galaxy S26 also fell to a two-bug chain, underscoring how modern flagships bundle enough attack surface for researchers to climb. But the Pixel dominated the dollar totals, making Android the clear headline of a hardware-security competition that has historically leaned toward browsers and printers.
The collision rule and what it means
The competition's results carry an important nuance. Several Pixel 10 wins were marked as a collision — meaning the vendor or organizers already knew about at least one of the underlying weaknesses, possibly because an earlier contestant disclosed it first. Collisions reduce an otherwise successful entry's reward. The point is that even partially known flaws, when chained, can still unlock a fully patched flagship. That matters because a single update cannot erase a whole chain of vulnerabilities layered across firmware, modem, and browser.
Adjacent context sharpens the picture. In September, Google separately patched a Pixel modem flaw, CVE-2026-58704, that it said "may be under limited, targeted exploitation," a high-severity weakness that could let a nearby attacker gain higher access without any user action. Patched in the September 2026 update level, it is a reminder that modem-level radio exploits — exactly the class that Pwn2Own rewards — are a persistent and hard-to-patch attack surface.
- Pwn2Own Ireland 2026 closed with over $1.26 million paid across 98 zero-days from 29 teams.
- Three teams remotely exploited a fully patched Google Pixel 10, earning more than $560,000 combined.
- Ikotas Labs took the top prize and the Master of Pwn title by chaining flaws.
- The rules accept browser or radio-link entry (NFC, Wi-Fi, Bluetooth, baseband), raising the bar for Android.
- Adjacent modem flaw CVE-2026-58704 was patched with a targeted-exploitation warning.
What this means for you
If you own a recent flagship, the practical takeaway is that being fully patched is not the same as being safe. Researchers can chain multiple small flaws to reach a fully updated device remotely, especially through radio links you carry with you — Wi-Fi, Bluetooth, NFC, or baseband. Keep your OS, modem, and browser updated, and if you handle sensitive work, be aware that a nearby attacker can target you without you tapping anything. For enterprises, treat modem and radio attack surfaces as a standing risk, not a footnote.
Sources: SecurityWeek: Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own; CyberInsider: Google Pixel 10 hacked as Pwn2Own Ireland wraps with $1.26 million in rewards; The Hacker News: Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own.
Corrections: Report an error at corrections@wireshaman.com.