Security researcher David Buchanan published an analysis on August 25 titled, in translation, "C2PA cameras don't survive contact with reality." His conclusion fits in one sentence: C2PA on Android is broken, and no routine patch can fix it.
Start with what the system is supposed to solve. Content Credentials tries to answer one question: was this photo shot by a camera or generated by a model? The approach has the camera sign the file with a hardware private key the instant it captures the image, embedding the device model, capture time, and any later edits into the signature. Google built this into the Camera app starting with the Pixel 10, storing the private key in the Titan M2's StrongBox and pairing it with Key Attestation and Play Integrity to verify device integrity. By design, the private key never leaves the secure chip — even a fully compromised OS can't extract it.
Not Stealing the Key — Borrowing It
Buchanan's point is that an attacker never needs to extract the private key at all. Once a device is rooted, an attacker can simply call the KeyStore API to ask StrongBox to sign arbitrary data with that key — the chip only signs, it has no way to check whether the bytes it's signing actually came from the camera sensor. He released two matching tools alongside the writeup: Root-My-Pixel to gain root, and keystork to call KeyStore.
Where does root come from? CVE-2026-43499, a one-tap privilege-escalation flaw that affects fully patched Pixel devices, including the Pixel 8a and 9a, with public exploit code already circulating in the wild. Meta patched the same flaw on its own Quest headsets before Google did, and Samsung's Real-time Kernel Protection (RKP) blocks part of the attack path.
He also demonstrated a second route: electromagnetic fault injection against DRAM. This path is more hardcore and far more involved — a physical-layer attack that no software patch can reach.
Google Closed the Report
Google marked the report "Won't fix," while still paying a $7,500 bounty — even though hardware attacks technically fall outside the bounty program's scope. That combination is itself a statement: Google accepts the flaw's severity but doesn't believe it can be fixed. The whole process followed a 90-day coordinated disclosure timeline.
The Assumption That Collapsed
C2PA's credibility rests on a single assumption: that a signature can only be produced by trusted hardware at a trusted moment. Once root access lets an attacker borrow the secure chip to stamp arbitrary content, the signature degrades into nothing more than "this device was involved" — and the device itself can be fully controlled. A forged photo carrying a legitimate Pixel signature will show as verified in any checker.
In the context of AI content governance, it's worth spelling out how much weight this layer carries. Embedded watermarks like SynthID make a positive claim — flagging content that was machine-generated. C2PA camera signatures make the opposite claim — certifying content as genuinely captured. Strip the former and content merely loses its label; forge the latter and you've handed synthetic content a certificate of authenticity. The two failure modes are not in the same order of magnitude.
A rough look at the exposure: Android holds over 70% of the global phone market, and if camera signatures are only trustworthy on a handful of models whose privilege-escalation flaws keep surfacing every quarter, then the habit of "trust it because it's signed" becomes the gap itself. A workable path forward is probably to downgrade the signature to a weak signal — cross-checked against capture location, timestamps, and distribution chain — rather than treating it as a standalone verdict.
Sources: David Buchanan's personal blog, CocoLoop, Google's Vulnerability Reward Program response, the public C2PA Content Credentials specification; the CVE-2026-43499 identifier, the $7,500 bounty amount, and affected device models are per the researcher's disclosure.