Pwn2Own: Another defeat for Samsung
At the Pwn2Own security conference in Ireland, security experts successfully cracked the current smartphone flagships from Samsung and Google. According to one team, a single email was enough.
Email attack successful
After both the Galaxy S22 and the Galaxy S23 were cracked in record time in recent years, hackers have once again targeted Samsung’s current flagship smartphones at this year’s edition of the Pwn2Own Ireland security conference. The software of the latest model, like that of its predecessors, did not cut a good figure. Google’s Pixel 10 was also successfully compromised. Japanese security team Ikotas Labs initially managed to take over the Galaxy S26 by combining four different security vulnerabilities. The experts then used the same vulnerability to execute code on the Pixel 10.
The attackers used a vulnerability that enables remote code execution to achieve the intrusion. Third parties can remotely execute their own program code on third-party devices. According to security experts, for a successful attack on Android devices, it was enough to send a single prepared email to the target device. They also claim to have found another, previously unpublished attack chain with which they were then able to gain deeper access rights in the system.
Hunt for undiscovered gaps
Pwn2Own is a regular competition for ethical hackers organized by the Zero Day Initiative. The goal is to find previously unknown vulnerabilities in fully updated systems. If a break-in is successful, the discoverers receive prize money. For taking over the Pixel 10, the Japanese team received the maximum bonus of $300,000 (around 267,000 euros).
In total, the organizers paid out more than $560,000 (around €498,000) to three teams for vulnerabilities they found in Google’s current smartphone. At least six vulnerabilities on the Galaxy S26 were exploited by various groups during the multi-day event. However, the Apple iPhone 17, which was also advertised as a target, remained untested.
Details still unknown
However, the hacker teams have not yet published any details about the hacks. It remains unclear whether users have to interact with the prepared email or whether simply receiving it allows the security gap to be exploited. The researchers won’t release the details until after a 90-day deadline to give Samsung and Google enough time to patch the holes.
Amit Gohar is Technical writer at ResearchSnipers.com, he is well versed Technology News writer, he has completed is MS computer Science in 2020. He can be reached at amit.g@researchsnipers.com
