Three research teams demonstrated remote hacks against a fully patched Google Pixel 10 at Pwn2Own Ireland in Cork on 8 October. The competition requires targets to be fully updated, and successful exploit chains are then disclosed to the affected vendors so patches can be developed. According to the source, one Pixel exploit from Ikotas Labs earned a $300,000 award and contributed to the team winning the event overall.

While Pwn2Own is a controlled security contest rather than a live criminal incident, the results matter for businesses because they show that even up-to-date mobile devices can still contain previously unknown vulnerabilities. For European companies that rely on smartphones for email, identity verification, collaboration apps and access to business systems, that is an important operational and security reminder.

What happened

Pwn2Own Ireland invited security researchers to attack selected technology products under contest rules that require the devices and software to be fully patched. During the event, three teams reportedly achieved remote compromises of Google's Pixel 10. The vulnerabilities demonstrated at the contest are typically shared privately with vendors under responsible disclosure processes rather than released immediately.

This does not mean businesses should assume widespread active exploitation. It does mean that previously unknown flaws can exist even in current, updated devices, and that vendors may need time to investigate and issue fixes after a successful demonstration.

Why it matters for European businesses

Many SMEs and larger organisations now treat smartphones as trusted endpoints. Employees use them for:

• multi-factor authentication and passkeys
• email and messaging
• mobile banking and payment approvals
• access to CRM, ERP and cloud administration tools
• customer data handling through business apps

If a device is compromised remotely, the impact can go beyond the handset itself. An attacker may be able to target business communications, intercept authentication flows or use a mobile device as a stepping stone into wider company systems. That is particularly relevant where bring-your-own-device policies, weak mobile device management or inconsistent access controls are in place.

The broader lesson is practical: patching is necessary, but patching alone is not a complete mobile security strategy. Businesses should combine updates with device management, least-privilege access, phishing resistance and monitoring of account activity.

Who may be affected

The immediate technical issue concerns Google Pixel devices, but the business takeaway is wider than one vendor or model. Companies most likely to care include:

• businesses that issue Android phones to employees
• organisations using smartphones for MFA, passkeys or privileged approvals
• remote and hybrid teams that depend on mobile access to SaaS platforms
• IT and security teams responsible for endpoint management
• regulated businesses handling sensitive customer or operational data on mobile devices

Smaller businesses can be especially exposed if the same mobile device is used for both personal and business activity without central management or clear separation of accounts and apps.

What companies should consider

• Keep mobile devices updated
  Events like Pwn2Own do not reduce the value of patching. They reinforce the need to apply vendor updates quickly once fixes become available.
• Review mobile device management
  Where possible, use MDM or equivalent controls to enforce screen locks, encryption, approved apps and update compliance.
• Reduce trust in a single device
  Do not rely on one smartphone as the only gatekeeper for sensitive approvals or administrator access. Consider stronger conditional access and secondary verification for high-risk actions.
• Harden identity workflows
  Assess how mobile devices are used for MFA, passkeys, email recovery and privileged login flows. A compromised device can create wider identity risks.
• Separate business and personal use
  For SMEs using employee-owned phones, clear BYOD rules and containerisation options can reduce exposure.
• Prepare for vendor advisories
  Security teams should watch for confirmed advisories or patches from Google and evaluate whether any temporary restrictions are needed for high-risk users until updates are available.

For European businesses, the main lesson is not to panic but to treat mobile devices as critical business endpoints. Security contests such as Pwn2Own show how quickly trust assumptions can break down when a phone also functions as an identity token, communications hub and access key to cloud systems.