started · updated
Samsung Galaxy S26 hacked three times at Pwn2Own Ireland
During the Pwn2Own Ireland 2026 competition in Cork, security researchers successfully compromised the Samsung Galaxy S26 flagship smartphone on three separate occasions. The exploits demonstrated during the event utilized various methods, including kernel use-after-free, binder IPC race conditions, and sandbox escapes via WebView to achieve privileged code execution.
On the first day of the competition, researchers demonstrated 32 previously unknown zero-day vulnerabilities across multiple platforms. Specific teams were rewarded for their findings: a researcher from Viettel Cyber Security earned $31,250, Interrupt Labs received $15,750 for an exploit involving a zero-day, and Ikotas Labs was awarded $11,000.
By the second day, researchers had collected a total of $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. The competition, organized by Trend Micro’s Zero Day Initiative (ZDI), aims to identify flaws in fully patched devices so vendors can address them before malicious actors can exploit them in the wild. Under competition rules, vendors are granted a 90-day window to deploy patches before ZDI publicly discloses the vulnerabilities.
Entities
Cork · Pwn2Own Ireland · Samsung · Viettel Cyber Security · Zero Day Initiative
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] Vendors have 90 days to patch software after zero-days are disclosed at Pwn2Own before public disclosure by ZDI. cybernoz.com
- [○ 1 SOURCE] A researcher from Viettel Cyber Security used four vulnerabilities to hack the device, earning $31,250. www.origo.hu
- [○ 1 SOURCE] The exploits used combinations of kernel use-after-free, binder IPC race conditions, and sandbox escapes. flagthis.com
- [● 2 SOURCES] Interrupt Labs hacked the Galaxy S26 using four vulnerabilities, including one zero-day, earning $15,750. www.origo.hu · cybernoz.com
- [● 2 SOURCES] Security researchers demonstrated 32 previously unknown zero-day vulnerabilities on the first day of Pwn2Own Ireland 2026. www.origo.hu · flagthis.com
- [○ 1 SOURCE] On the second day of the competition, researchers collected $232,500 for exploiting 45 unique zero-day vulnerabilities. cybernoz.com
- [● 3 SOURCES] The Samsung Galaxy S26 flagship was successfully hacked three separate times during the competition. www.origo.hu · cybernoz.com · flagthis.com
- [○ 1 SOURCE] Ikotas Labs breached the device using four vulnerabilities, earning $11,000. www.origo.hu