Android C2PA Cameras Survive Nothing — The Provenance Promise Is Broken
David Buchanan (retr0id) published a thorough takedown yesterday of C2PA camera signatures on Android. The tl;dr: the "strongest" C2PA implementation on the market is trivial to bypass, and the hardware vulnerabilities can't be patched.
Buchanan demonstrates three broken paths:
- Software root via LPE: CVE-2026-43499 gives one-click root on fully-patched Pixel devices. Once rooted, C2PA keys live in StrongBox/Titan M2 — but root can use them without extracting them. Sign arbitrary data with the camera's identity. No key material needed.
- Hardware fault injection: Low-cost glitching attacks bypass Key Attestation at the hardware level. These vulnerabilities are baked into silicon — they don't get patched.
- Play Integrity bypass: Same story, different layer. Google's attestation can't tell the difference between a legit camera app and one running on a rooted device with locked bootloader.
The Pixel Camera app achieved Assurance Level 2 — the highest C2PA conformance certification currently defined. Buchanan is clear: "I'm attacking the 'strongest' implementation, just to make a point." The point landed.
flowchart LR
A[Camera Sensor] --> B[C2PA App]
B --> C{Key Attestation}
C -->|Locked BL| D[StrongBox Keys]
D --> E[Sign Image]
F[Root LPE] -.-> C
G[Fault Injection] -.-> C
H[Play Integrity Bypass] -.-> C
style F stroke:#ef4444,stroke-dasharray: 3
style G stroke:#ef4444,stroke-dasharray: 3
style H stroke:#ef4444,stroke-dasharray: 3
Buchanan calls this the "lowest-hanging fruit" — and he's right. What makes this devastating isn't the specific attack chain; it's the architecture. C2PA's trust model assumes the device is a sealed box. Android isn't. The attestation layer was designed for DRM and banking, not for proving an image came from a specific sensor at a specific time. The requirements are fundamentally different.
Apple's rumored provenance solution might work better given their vertical integration — but Buchanan notes that would shift attacks into the optical domain (screenshots of screens, monitor rephotography), which are harder to detect at scale and already have solutions in the forensic community.
Why It Matters
C2PA is becoming mandatory infrastructure. Major ad platforms are requiring C2PA credentials for political ads. News organizations are building verification pipelines around it. Camera manufacturers are shipping C2PA support as a feature. If the highest-assurance Android implementation is toothless against an attacker with root, the entire provenance layer is built on trust assumptions that don't match reality.
Buchanan reported his findings 90+ days ago. Google removed the "Captured with a camera" tag from YouTube videos the day the post went live. That's damage control, not a fix. The architecture doesn't have one.