Samsung Galaxy S26 Hacked via Single Email as Researchers Pitch Zero-Day for State 'Hack Backs'

Japanese security firm Ikotas Labs successfully executed remote code on the Samsung Galaxy S26 at the Pwn2Own Ireland 2026 competition using a single email. The compromise utilized a chain of four vulnerabilities, including three previously unknown flaws, earning the team an $11,000 reward from the Zero Day Initiative. The event witnessed three successful attacks on the Galaxy S26 in total, uncovering five new flaws across demonstrations by Ikotas, Viettel Cyber Security, and Interrupt Labs. Ikotas stated the zero-day vulnerability also affects Google's flagship phones and is scheduled to attempt a remote hack of the Pixel 10 on October 8th. The security firm is actively positioning its research for offensive hacking, suggesting the tools could be used for criminal probes and state-sanctioned "hack back" powers in Japan. "While we received a $11,000 bounty, the joy of demonstrating our technical prowess on the global stage is even greater." — Ikotas