Pwn2Own Ireland 2026: Two Phones, Two Successful Exploits, and Third Place

Last week, I traveled to Ireland to compete in Pwn2Own Ireland 2026. I teamed up with Dimitrios and Tenia Valsamara to form Team ZyGoat.

Keeping with our zygote-inspired team name, we decided to focus exclusively on Android smartphones, specifically the Samsung Galaxy S26 and Google Pixel 10.

Despite competing in only two categories, we successfully compromised both devices, earning a total of $125,000 in prize money, 27.5 Master of Pwn points, and third place overall.

Fierce Competition

This year’s mobile categories were particularly competitive, with eight entries targeting the Samsung Galaxy S26 and four targeting the Google Pixel 10.

For those unfamiliar with Pwn2Own, the order in which contestants attempt their exploits can have a significant impact on the final results.

Before the competition, contestants are assigned an order in which they’ll demonstrate their exploits. This matters because independently discovered vulnerabilities can overlap with those submitted by other teams or with vulnerabilities already known to the vendor.

These overlaps are called bug collisions, or dups, and can result in reduced prize money and Master of Pwn points, even when the exploit itself is successful.

Unfortunately for us, we were selected to go fourth for both devices. With several teams ahead of us, there was always the possibility that another team would demonstrate one of our vulnerabilities first.

Samsung Galaxy S26: A Unique Vulnerability

Our first target was the Samsung Galaxy S26.

For this entry, we discovered and exploited a single vulnerability that allowed us to obtain System privileges on the device.

To demonstrate the impact of our exploit, we used these privileges to activate the device’s camera and stream its video feed to a remote server under our control.

Our attempt was successful, but what made this result particularly exciting was that we were the only team in the Samsung Galaxy S26 category whose entry did not collide with another known vulnerability.

This meant our vulnerability was recognized as unique, with no previously known overlap identified during disclosure.

• $12,500 in prize money
• 5 Master of Pwn points
• One unique vulnerability

With eight entries competing against the same device, having the only non-colliding entry was an especially satisfying result.

Google Pixel 10: Success, With a Collision

Our second target was the Google Pixel 10.

Unlike our Samsung exploit, which relied on a single vulnerability, our Pixel entry required chaining two separate vulnerabilities to obtain System privileges.

Once again, we demonstrated the impact by activating the camera and streaming its video feed to our remote server.

The exploit worked as intended, and we successfully compromised the device.

However, during disclosure, we learned that one of the vulnerabilities in our exploit chain overlapped with a vulnerability used by Ikotas Labs in their own Pixel 10 entry.

This resulted in our submission being classified as a successful attempt with a bug collision, reducing our award to:

• $112,500 in prize money
• 22.5 Master of Pwn points

This is one of the more interesting aspects of competing at Pwn2Own. Vulnerability research requires skill, persistence, and creativity, but sometimes a little luck also plays a role.

Our exploit was independently developed, and it worked exactly as we intended. However, because another team demonstrated the overlapping vulnerability before us, our final award was reduced.

That’s simply part of the Pwn2Own game!

Two Phones Were Enough for Third Place

Going into the competition, our focus was entirely on mobile devices. We didn’t enter any of the other categories.

We had just two targets, and we successfully exploited both.

Even with a collision affecting our Pixel submission, our combined results were enough to secure third place overall in Pwn2Own Ireland 2026.

Our final results:

• Overall placement: Third place
• Successful entries: 2 out of 2
• Total prize money: $125,000
• Master of Pwn points: 27.5
• Devices compromised: Samsung Galaxy S26 and Google Pixel 10

Another personal highlight is that this marks two consecutive Pwn2Own competitions in which we’ve successfully obtained System privileges on a total of 3 mobile devices.

No Memory Corruption Required

Across both devices, we used three vulnerabilities in total:

• One vulnerability against the Samsung Galaxy S26.
• Two vulnerabilities chained together against the Google Pixel 10.

Not a single one was a memory corruption vulnerability.

Instead, all three vulnerabilities stemmed from application logic flaws involving the unsafe handling of attacker-controlled data.

Our results demonstrate that significant privilege escalation is still possible through application logic vulnerabilities alone, even on modern flagship Android devices with extensive security protections.

By chaining or exploiting these flaws, we were able to cross security boundaries and obtain System privileges without relying on a traditional native exploit.

This highlights the importance of application security (AppSec) and identifying logic vulnerabilities, particularly as smartphones become increasingly central to our daily lives. From mobile banking and financial transactions to authentication, personal communications, and the storage of sensitive information, we rely on these devices to perform operations that demand strong security guarantees.

While memory safety protections and exploit mitigations continue to improve, application logic vulnerabilities can still allow attackers to bypass intended security boundaries. Securing modern mobile devices requires more than protecting against memory corruption; it also means ensuring that applications correctly validate untrusted inputs, enforce authorization checks, and handle interactions between components with different privilege levels.

AI-Assisted Mobile Research with Djini.ai

As part of Team ZyGoat, I also used Djini.ai to assist with my mobile security research leading up to Pwn2Own.

Djini.ai is an AI-powered mobile security research platform designed to automate vulnerability discovery and analysis in Android and iOS applications. It uses autonomous AI agents to help researchers investigate application behavior, identify security vulnerabilities, and validate potential exploitation paths.

The platform provides several capabilities particularly relevant to mobile vulnerability research, including:

• Agentic Code Intelligence: AI-driven analysis that understands application context, traces data flows, and identifies potentially vulnerable execution paths.
• Reverse Engineering: Tools to help researchers understand application internals and investigate complex mobile attack surfaces.
• Agentic Runtime Testing: Autonomous agents that interact with applications, execute application flows, explore edge cases, and validate vulnerabilities at runtime.application internals and investigate complex mobile attack surfaces.
• Exploit PoC Studio: Capabilities aimed at helping researchers develop and validate proof-of-concept exploits.

One of the biggest challenges in Android security research is understanding how attacker-controlled data moves between application components, particularly when that data eventually reaches code executing with elevated privileges.

This was especially relevant to our Pwn2Own research, where all three vulnerabilities involved application logic issues rather than memory corruption.

I incorporated Djini.ai into my mobile research workflow as an AI-assisted tool alongside traditional vulnerability research techniques. Its focus on understanding application behavior, tracing data flows, and investigating potential security issues aligns closely with the type of research needed to identify application logic vulnerabilities.

While AI-assisted tools can accelerate parts of the research process, they don’t eliminate the need for a researcher to understand the underlying system, determine exploitability, and develop a reliable exploit.

Try Djini.ai for Free

One of the goals with Djini.ai is making mobile application security testing accessible, whether you’re an independent researcher or part of a development team. That’s why we’ve made several capabilities available for free:

• 10 free SAST scans every month: Analyze Android and iOS application source code using AI-assisted static analysis.
• Free CI/CD integration: Integrate automated security testing into your development pipeline using GitHub Actions and SARIF output.
• One free full black-box scan: Test your mobile application using AI-assisted dynamic analysis to investigate runtime behavior and identify potential vulnerabilities.

Ready to scale your mobile security testing?

See how Djini.ai helps security teams automate mobile app assessments and accelerate vulnerability discovery.

Start Free Trial

Prefer a walkthrough? Book a demo

What’s Next?

As with all Pwn2Own submissions, the vulnerabilities we demonstrated are subject to coordinated disclosure through the Zero Day Initiative (ZDI) and the affected vendors.

We’ll be holding off on publishing the technical details until the vulnerabilities have been appropriately addressed.

Overall, Pwn2Own Ireland 2026 was an incredible experience. Between the fierce competition, the uncertainty of bug collisions, and the excitement of demonstrating our exploits, it was a memorable week.

I’m especially proud that Team ZyGoat managed to take third place overall while focusing exclusively on two smartphones.

A huge thanks to Dimitrios and Tenia Valsamara for teaming up with me, and to the ZDI team for organizing another fantastic Pwn2Own competition.

If you’re interested in mobile security research, I encourage you to check out Djini.ai and give it a try. Whether you’re researching Android or iOS vulnerabilities, reverse engineering applications, or investigating complex application logic issues, Djini.ai offers AI-assisted tools that can complement your existing research workflow.

You can learn more about its capabilities and get started at https://djini.ai/.

Two phones. Three vulnerabilities. Two successful exploits. Third place. Not bad for Team ZyGoat!