Sources
C2PA camera provenance on Android is broken in a way that cannot be patched, using root and a tool that asks StrongBox to sign anything
David Buchanan got root on fully-patched Pixel devices two ways, via electromagnetic fault injection flipping page table entry bits and via the public Root My Pixel exploit for CVE-2026-43499. He then used a tool he calls keystork to impersonate the Pixel Camera app and have StrongBox sign arbitrary content with its C2PA credentials, without ever extracting key material from the secure element. That defeats the highest C2PA security rating and by extension every Android camera app relying on Key Attestation or Play Integrity. His conclusion is that the hardware side cannot be fixed in software, so a C2PA signature on an Android photo should not be treated as evidence of capture.
↳ Follow the thread