Cens-ational exploit by Dimitrios Valsamaras (@Ch0pin), Ken Gannon / 伊藤 剣 (@Yogehi) using djini from Mobile Hacking Lab, Tenia Valsamara (@ir3l14) from CENSUS Labs targeting Google Pixel 10 for a total of $112,500 and 22.50 Master of Pwn points with a 2 bug chain, 1 collision
That’s a wrap for Team ZyGoat at Pwn2Own 2026.
Two attempts, two successful exploits — one against Samsung and one against Pixel. We finished in 3rd place. The draw could have been better, but that’s part of the competition. CC: @Yogehi , @ir3l14
1 bug wonder! With an Confused Deputy (CWE-441) bug Dimitrios Valsamaras (@Ch0pin), Ken Gannon / 伊藤 剣 (@Yogehi) using Djini.ai from Mobile Hacking Lab, Tenia Valsamara (@ir3l14) from CENSUS Labs PwN'ed the Samsung Galaxy S26 #Pwn2Own
まだ日本語が上手ではないので、英語で話します。でも、日本のユーザーのタイムラインに表示されるように、この部分だけは日本語で言いたいと思います。
All vulnerabilities demonstrated at Pwn2Own are disclosed directly to the vendor.