C2PA Cameras Do Not Survive Contact With Reality

A security researcher demonstrates that C2PA's cryptographic image-provenance system on Android is fundamentally broken, despite Google's Pixel Camera app holding the highest C2PA conformance rating (Assurance Level 2). The scheme relies on Android Key Attestation and Google Play Integrity to prevent apps from signing arbitrary files, but root privilege escalation exploits defeat both. A currently in-the-wild one-click root exploit for fully-patched Pixel devices (CVE-2026-43499) lets anyone sign AI-generated fake images and videos as authentic camera captures, no hardware attack required. The researcher published tools (Root My Pixel, keystork) and a proof-of-concept, showed the same flaw affects nearly all Android C2PA camera apps using the same attestation methods, noted low-cost hardware fault-injection attacks also work regardless of patch level, and revealed Google closed the bug report as 'Won't fix (infeasible)' while still awarding a $7500 bounty. A separate private key disclosure bug was reported and patched within two days.

Source: https://www.da.vidbuchanan.co.uk/blog/android-c2pa.html. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.