Samsung Galaxy S26 Exploited: 32 Zero-Days Demonstrated on Day One of Pwn2Own Ireland 2026
On October 6, 2026, the opening day of Pwn2Own Ireland 2026 in Cork, security researchers demonstrated 32 previously unknown zero‑day vulnerabilities across multiple platforms, with the Samsung Galaxy S26 (Android 15) serving as a primary high‑value target. Three distinct exploit chains compromised the device, combining kernel use‑after‑free, binder IPC race conditions, and sandbox escapes via WebView to achieve full privileged code execution. The chains earned $342,500 in awards for 28 zero‑days (some incorporating known CVEs). The findings underscore the depth of mobile attack surfaces and the effectiveness of multi‑stage exploits that blend memory‑corruption, logic flaws, and privilege‑escalation primitives, placing millions of Galaxy S26 devices at risk until vendor patches are deployed.