Remote Exploits Bypass Full Patches on Google Pixel 10 at Pwn2Own Ireland

Three independent security research groups demonstrated that a fully patched Google Pixel 10 could be taken over remotely during the Pwn2Own Ireland competition in Cork on October 8, marking a rare instance where a device with the latest updates was compromised without physical access.

The event, organized by the Zero Day Initiative, obliges participants to target devices that have applied every vendor‑issued fix. Contest rules therefore require that any successful exploit must work against the most current software, raising the bar for both attackers and defenders.

Each team presented a separate remote code‑execution chain that leveraged previously unknown flaws in the phone's operating system. The vulnerabilities were not publicly disclosed before the demonstration, and Google has confirmed that the issues will be incorporated into upcoming security patches. By delivering working exploits, the researchers earned cash rewards and helped the vendor prioritize remediation.

Pwn2Own, which began in 2007, has become a cornerstone of the vulnerability‑research ecosystem. Over the years, the contest has uncovered critical bugs in browsers, operating systems, and increasingly, mobile platforms. Its “full‑patch” format, introduced in recent editions, pushes manufacturers to harden devices against attacks that could be launched from anywhere on the internet.

The successful hacks of the Pixel 10 underscore the continuing arms race between hardware makers and security researchers. Even with diligent update practices, complex software stacks can harbor subtle weaknesses that only sophisticated, weaponized analysis can reveal. Google’s participation in the program signals a commitment to rapid, responsible disclosure, as the company typically works with the discoverers to integrate fixes before public release.

Looking ahead, the findings from this year's competition are expected to influence the security roadmap for Android devices. Analysts anticipate that future Pwn2Own events will maintain the focus on remote, fully‑patched targets, encouraging vendors to adopt more proactive defense mechanisms such as stronger sandboxing and improved verification of code paths. The incident serves as a reminder that staying current with updates, while essential, is not a guarantee against all threats, and that collaborative research remains vital to safeguarding the mobile ecosystem.