Ikotas Labs wins Master of Pwn after hacking a Pixel 10
Zero Day Initiative's contest closed with three attacks on Google's Pixel 10; the flaws still have no CVE or patch and change nothing for users for now.
Nothing changes for now for anyone with a Pixel 10 or a Galaxy S26: the flaws demonstrated at Pwn2Own Ireland have no CVE identifier or public patch, and the manufacturers receive them privately to fix them. What may come are security updates from Google and Samsung that close those errors. Google and Samsung have not published a statement.
The Zero Day Initiative (ZDI), which runs the contest, summarized the third and final day of the 2026 edition and declared Ikotas Labs the Master of Pwn. The company earned $300 000 and 30 points for chaining several bugs against the Pixel 10. Pwn2Own pays researchers to demonstrate live attacks on fully updated products, and the ZDI notifies vendors before disclosing anything. On the first day of the contest the Pixel 10 had still held out.
Three attacks on the Pixel 10
Google's phone was the main target on Thursday:
| Team | Prize (US dollars) | Points |
|---|---|---|
| Ikotas Labs | 300 000 | 30 |
| Xint (Tim Becker and Yves Bieri) | 150 000 | 15 |
| Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara | 112 500 | 22.5 |
Xint used a collision, meaning a bug another contestant had already submitted, which is why the prize is smaller. The Valsamaras team combined two flaws: a collision and a zero-day, a flaw the vendor did not know about.
Samsung's Galaxy S26 had already fallen in all three attempts on day two, according to the ZDI, and day three added one more attack, by the BunkyoWesterns team, for $8 250. Other payouts on Thursday included $20 000 for FuzzingLabs on a Brother MFC-L8970CDW printer, $7 500 for Team MAMMOTH on a Home Assistant Green and two payouts of $6 250 and $6 000 for Oracle Autonomous AI Database. White Noise Club failed against a Garmin Index BPM.
The ZDI announced 17 attempts and "roughly $1.33 million on the board" for the day, but that figure is what was on offer, not what was paid. This report does not add up the event's final totals because the ZDI does not publish them in the pages consulted. The results come from the organizer itself and there is no independent verification of the payouts.
