Three Teams Remotely Exploit Fully Patched Pixel 10 at Pwn2Own Ireland

Fri, 09 Oct 2026 17:26:04 +0000

Engineer — Learn: Remote code execution on a fully patched Pixel 10 is noteworthy research, but no patch or public PoC is available yet and mobile handsets are outside the typical cloud/AppSec engineering stack; monitor Google’s security bulletins for patches once they drop.
SOC/IR — Learn: Contest rules channel these exploits to the vendor privately, so there are no IOCs, public TTPs, or active exploitation signals to hunt; file as background awareness of Pixel attack surface until Google publishes details.
Leader — Learn: A controlled competition result with no active exploitation; if the org manages a corporate Pixel fleet, note that remote compromise of fully patched devices is now demonstrated and watch for Google’s patch announcement to assess MDM policy response.

Mobile-Exploit on CuraSec