A security researcher has demonstrated that C2PA — the content provenance standard meant to verify that photos and videos are real — can be forged on Android devices using publicly available tools. David Buchanan, known online as retr0id, published his findings on 25 August, showing that the cryptographic chain C2PA relies on breaks down once an attacker gains root access to a device.
The implications are serious. The EU AI Act’s content transparency requirements — which mandate machine-readable marking of AI-generated media — became enforceable on 2 August 2026. C2PA is a core part of that infrastructure. If it can be circumvented, the regulatory framework built on top of it has a problem.
What C2PA was supposed to do
C2PA — short for Coalition for Content Provenance and Authenticity — is a standard for cryptographically signing media files to record their origin and editing history. Camera apps sign photos at the moment of capture, creating a “content credential” that theoretically proves the image came from a real camera sensor, not a generative AI model.
Google’s Pixel Camera app achieved Assurance Level 2, the highest security rating currently defined by the C2PA Conformance Program — and, Google noted, currently only possible on Android. The system relies on Android’s Key Attestation and Google Play Integrity to prevent tampering.
How the attack works
Buchanan’s argument is straightforward. C2PA camera apps on Android depend on the device not being rooted. If an attacker gains root access, they can ask the hardware security module to sign arbitrary data — including AI-generated images — as if it came from the camera sensor. The cryptographic keys stay safe inside the hardware. But the attacker doesn’t need the keys. They need the signatures, and root access lets them get those.
The critical link is the root exploit itself. Buchanan points to CVE-2026-43499, a vulnerability in fully-patched Google Pixel devices for which one-click root exploits exist in the wild. He personally tested the attack on Pixel 8a and 9a devices. He also demonstrated hardware-based fault injection attacks — using a modified cigarette lighter, of all things — that can root devices regardless of software patch level.
Google closed Buchanan’s bug report with the status “Won’t fix (infeasible)” and awarded him a $7,500 bounty. Their reasoning: hardware glitching and side-channel attacks are out of scope for their vulnerability reward programme. Buchanan’s response: “The most obvious C2PA attack vector is out of scope for Google’s VRP. Thus, the VRP does not meaningfully protect Android C2PA implementations.”
He also noted that Meta patched the same CVE on Quest headsets earlier in August — to stop cheating in VR games — while Google has not issued a patch for its flagship Pixel devices.
Why a software patch isn’t enough
Even if Google patches CVE-2026-43499 tomorrow, the problem doesn’t go away. Two issues remain.
First, anyone with sufficient resources — governments, mobile forensics companies — can stockpile private exploits. These are exactly the groups most likely to want to forge C2PA signatures.
Second, the hardware attacks Buchanan demonstrated can’t be patched. They exploit the physics of external memory, and fixing that would require running the entire image processing pipeline inside a secure enclave with strong hardware memory protection. Buchanan doesn’t think Google will do that: “It just doesn’t make sense to do all that rearchitecting, when you still can’t stop ‘picture of screen’ style attacks.”
He demonstrated the point by publishing an AI-generated image that C2PA verification tools say is a real, unedited photograph straight from a Pixel Camera app — and a YouTube video the platform labelled as “captured with a camera” that wasn’t.
The broader provenance problem
This is not just an Android issue. The C2PA standard’s trust model assumes that the signing hardware hasn’t been compromised. Buchanan’s work shows that assumption is fragile on the world’s most popular mobile platform. Other C2PA camera apps on Android that rely on the same attestation methods are vulnerable in the same way — and they’re not limited to Pixel devices, meaning an attacker can pick the cheapest, most vulnerable device in the ecosystem.
Apple is rumoured to be working on its own media provenance solution for iOS 27, bypassing C2PA entirely. We covered that fork earlier this month — and the fragmentation it creates is itself a problem. If the major platforms can’t agree on a standard, and the standard they do have can be broken, the verification layer gets weaker, not stronger.
The timing is uncomfortable. The EU’s content transparency rules are now live. OpenAI adopted C2PA and SynthID watermarks for its generated images in May. New Zealand’s deepfake bill passed its first reading unanimously. The regulatory and technical infrastructure for content provenance is being built right now — and one of its load-bearing walls has a crack that can’t be patched.
What stands out
Buchanan isn’t arguing that C2PA is useless. He’s arguing that its security model has a limit, and that limit is lower than its proponents claim. The standard still adds friction — it raises the cost and complexity of forgery. But the gap between “raises the cost” and “prevents it” matters when the regulatory frameworks of major economies are being built on the assumption that the technology works as advertised.
The honest framing is this: C2PA is a speed bump, not a wall. It helps. It doesn’t solve the problem. And the people building policy on top of it should know the difference.
