The short version: yes, a Google Pixel 10 was broken into, but at a controlled contest, not in the wild. At Pwn2Own Ireland 2026, run by Trend Micro's Zero Day Initiative in Cork, three separate teams demonstrated remote exploits against a Pixel 10 on October 8. The rules require every target to be fully patched. Ikotas Labs chained several bugs for the $300,000 top prize, Xint used a single bug collision for $150,000, and a team from Mobile Hacking Lab and CENSUS Labs earned $112,500. That totals $562,500.
What's still unknown: ZDI had not published how the exploits work as of October 9, and no CVE identifiers had surfaced in the coverage I found. Vendors get the details first, and ZDI normally waits about 90 days before publishing technical information, so Google's patches will matter more than the headline. Reports also say no active exploitation in the wild has been seen.
I could only check the event coverage, not the blog post itself, so I can't tell you what it adds. It's worth reading the ZDI results and the news write-ups to see what was actually shown. What do you make of a phone being judged "secure" when it can be broken under contest rules?
