- Sources: primary, discussion
- Summary: David Buchanan published first-hand research signing forged C2PA images and video on a fully patched Pixel device, with a proof of concept. The post's thesis is that C2PA on Android cannot be realistically patched, because low-cost hardware fault injection yields valid signatures regardless of patch level, and the published demo image and video were signed through the hardware attack rather than the software path. It names CVE-2026-43499 as a one-click root path that still works at current Pixel patch levels with the bootloader locked, and states that Meta patched that CVE on Quest earlier this month while Google has shipped no Pixel patch. Google closed the report as Won't fix (infeasible) and paid a 7,500 dollar bounty for an attack class its bug bounty formally excludes. The post states that every Android C2PA camera app resting on Key Attestation or Play Integrity breaks the same way, so the result is not Pixel-specific. One counterexample is in the post: the author's PTE bit-flip step stopped working on a Samsung A07 after an update enabled Samsung's RKP mitigation, whose EL2 hypervisor blocks the overwrite, and he states he has untested plans to work around it. The post also states that a separate private key disclosure was reported and patched within a day while most C2PA verifiers do not check revocation.
- Why it matters: C2PA on Android rests on Key Attestation and Play Integrity, a rooted-but-locked device defeats both, and the hardware path defeats them at any patch level, so the signature is not evidence that a camera captured the image.
- Follow-up: Track whether Google revises the hardware attestation basis for C2PA on Android, or the bug bounty scope for this attack class.
send feedback on this story