GoKawiilSecurity researcher shows C2PA image-authentication scheme breaks down on Android
Researcher David Buchanan demonstrated that C2PA, the standard meant to cryptographically verify photos come straight from a camera, can be defeated on Android devices. He shows that root exploits, including a currently in-the-wild one-click attack (CVE-2026-43499) against fully patched Google Pixel phones, let attackers bypass Android's Key Attestation and Play Integrity protections that C2PA camera apps rely on, allowing arbitrary files to be signed as if they were genuine camera captures.