Security researchers successfully breached the Samsung Galaxy S26 a total of 7 times during the Pwn2Own Ireland event. The attacks succeeded despite the device running the latest official firmware with every current security patch installed. Organizers verified all 7 exploits over a 3 day testing period.
Researchers breached the phone 6 times during the first 2 days. The initial day saw 3 separate compromises, each using a chain of 4 software bugs that mixed newly discovered flaws with issues Samsung already knew about. The second day produced 3 more breaches, including 1 exploit relying entirely on a single Confused Deputy bug and 2 attacks combining new vulnerabilities with existing flaws. On the third day, a research team executed a remote breach using a chain of 2 bugs.
Pwn2Own guidelines require every target to run completely current software. Participants can submit previously known bugs, though organizers reduce the cash payout if a vendor already had prior knowledge of the issue. Whether these exploits pose an immediate threat to everyday Galaxy S26 owners remains unclear. Attacks at this event require months of preparation under strict laboratory conditions, and technical details remain private while Samsung works on security fixes.
