Remote Code Execution Demonstrated on Fully Patched Google Pixel 10 Devices at Pwn2Own Ireland
What Happened — Three independent research teams successfully executed remote code execution against Google’s Pixel 10 smartphone during the Pwn2Own Ireland contest on 8 October 2026. The devices were running the latest public firmware, and the contest rules require every target to be fully patched. One team (Ikotas Labs) earned the top prize of $300 k for the most impactful exploit.
Why It Matters for Trust & Control Assurance
- The event shows that even fully‑patched endpoints can harbor unknown flaws, underscoring the need for continuous control‑assurance programs that verify patch effectiveness over time.
- Mapping these zero‑day findings to a “Patch Management” control objective provides a defensible audit trail that satisfies multiple frameworks (e.g., NIST CSF 2.0).
- Verisq’s Control Mapping capability can automatically correlate newly disclosed vulnerabilities with your existing control evidence, helping you demonstrate due‑diligence to auditors.
Who Is Affected
- Mobile device manufacturers and OS vendors (Google, OEMs).
- Enterprises that rely on BYOD or MDM solutions to manage Android endpoints.
- Security teams responsible for vulnerability management and patch validation.
Recommended Actions
- Integrate threat‑intel feeds that surface zero‑day exploits into your vulnerability‑management workflow.
- Validate that your patch‑verification controls capture not only vendor‑released patches but also independent security research outcomes.
- Map the “Patch Management” control to evidence in your Trust Center to show continuous monitoring and remediation. Source: The Hacker News
Technical Notes
- Exploits leveraged a combination of kernel‑level privilege escalation and media‑framework code execution.
- No CVE identifiers were assigned at the time of disclosure; Google is expected to issue advisories in the coming weeks.
- Attack vector: remote network‑based exploitation without user interaction (zero‑click). Source: The Hacker News