Researchers compromised the C2PA cryptographic signature on Google Pixel 10

An independent researcher demonstrated the possibility of forging C2PA metadata, creating an image that successfully passes authenticity checks as taken with a Google Pixel 10 smartphone camera. During the experiment, it was possible to embed neural network-generated content into the verification system while maintaining a valid cryptographic device signature. To implement the attack, it took about 3 hours of work, as a result of which the system recognized the generated "glitter milk" image as an original snapshot. The researcher received 10 points in the vulnerability assessment, proving that the current implementation of the standard does not guarantee protection against the introduction of synthetic content at the hardware level. The C2PA (Coalition for Content Provenance and Authenticity) standard is designed to confirm the origin of media files and combat deepfakes. However, this incident shows that the presence of a "digital fingerprint" of the device is not absolute proof that the image was created by the camera's optical matrix, rather than an algorithm. The research results cast doubt on the reliability of existing content verification tools used in the media industry. The vulnerability indicates the need to revise the protocols for interaction between the security hardware modules of smartphones and the software layers responsible for forming metadata in real-time.