A Pixel bug lets attackers forge C2PA content credentials — and Google says it won’t fix it

A security researcher has shown that the cryptographic chain underpinning C2PA content credentials can be broken on Android devices, using publicly available tooling and a vulnerability that remains unpatched on Google’s flagship Pixel phones.

David Buchanan, who publishes research under the handle retr0id, detailed the attack in a write-up released in late August. The findings land in the middle of a regulatory shift: the EU AI Act’s content transparency rules, which require machine-readable marking of AI-generated media, became enforceable in early August. C2PA is positioned as a core technical layer for meeting that obligation.

How C2PA is meant to work

C2PA, the standard developed by the Coalition for Content Provenance and Authenticity, is designed to cryptographically sign media files at the point of capture. A camera app records a “content credential” that ties an image to the sensor that produced it, theoretically distinguishing a real photograph from a generative AI output.

Google’s Pixel Camera app reached Assurance Level 2 under the C2PA Conformance Program — the highest rating currently available, and one Google says is only possible on Android. The system depends on Android’s Key Attestation and Google Play Integrity to prevent the signing keys from being misused.

The attack

Buchanan’s argument is that C2PA’s Android implementation assumes the device hasn’t been rooted. With root access, an attacker can ask the device’s hardware security module to sign arbitrary data — including AI-generated images — as though it came from the camera sensor. The signing keys themselves remain protected inside the hardware. The attacker doesn’t need the keys; root access gives them the signatures.

The weak link is the root exploit itself. Buchanan points to CVE-2026-43499, a vulnerability in fully patched Pixel devices for which one-click root exploits already circulate. He tested the attack on Pixel 8a and 9a hardware. He also demonstrated hardware fault-injection attacks — using a modified cigarette lighter — that can root devices regardless of their software patch level.

Google closed Buchanan’s bug report as “Won’t fix (infeasible)” and paid a $7,500 bounty. The company’s stated position is that hardware glitching and side-channel attacks fall outside the scope of its vulnerability reward program. Buchanan’s reply: “The most obvious C2PA attack vector is out of scope for Google’s VRP. Thus, the VRP does not meaningfully protect Android C2PA implementations.”

He also flagged that Meta patched the same CVE on Quest headsets earlier in August — to prevent cheating in VR games — while Google has not shipped a patch for its own Pixel devices.

Why patching the CVE isn’t enough

Even if Google ships a fix, the underlying weakness persists. Two issues remain.

First, well-resourced attackers — including government agencies and mobile forensics vendors — can stockpile private exploits. These are the same actors most likely to want to forge C2PA signatures. Second, the hardware attacks Buchanan demonstrated cannot be patched through software. They exploit physical characteristics of external memory, and closing that gap would require moving the entire image processing pipeline into a secure enclave with strong memory protection.

Buchanan doesn’t expect Google to take that step. As he put it: “It just doesn’t make sense to do all that rearchitecting, when you still can’t stop ‘picture of screen’ style attacks.”

To illustrate the practical impact, he published an AI-generated image that C2PA verification tools accept as an unedited Pixel Camera photograph, and a YouTube video the platform labelled as “captured with a camera” despite having no such origin.

A wider provenance problem

The issue extends beyond Android. C2PA’s trust model rests on the assumption that the signing hardware hasn’t been compromised. Buchanan’s work suggests that assumption is fragile on the most widely deployed mobile platform. Other C2PA camera apps on Android rely on the same attestation mechanisms and are vulnerable in the same way, and they aren’t limited to Pixel hardware — an attacker can choose the cheapest, most exploitable device in the ecosystem.

Apple is reported to be developing its own media provenance system for a future iOS release, bypassing C2PA entirely. That kind of fork creates its own problem: if the major platforms can’t agree on a standard, and the standard they have can be circumvented, the verification layer gets weaker rather than stronger.

The regulatory context makes the timing sensitive. The EU’s content transparency rules are now in force. OpenAI adopted C2PA and SynthID watermarks for its generated images earlier in the year. New Zealand’s deepfake legislation has progressed through an initial parliamentary stage. The policy and technical scaffolding for content provenance is being assembled now, and a load-bearing part of it has a crack that cannot be patched through ordinary means.

What the research actually shows

Buchanan isn’t claiming C2PA is worthless. His point is that its security model has a limit, and that limit sits lower than its proponents suggest. The standard still adds friction — it raises the cost and complexity of forging credentials. But the gap between “raises the cost” and “prevents it” becomes significant when major regulatory frameworks are being built on the assumption that the technology performs as advertised.

C2PA functions as a speed bump rather than a wall. It helps. It does not solve the problem. The people writing policy on top of it should know the difference.