How a Fake Photo of 'Glitter Milk' Broke Google's Photo Verification

Content Credentials, built on a standard called C2PA, is supposed to answer a simple question: did a camera really take this photo? A Google Pixel 10 Pro can cryptographically sign an image the moment its camera captures it, attesting that the file came from real hardware rather than a generator. Security researcher Neal Krawetz, who runs the Hacker Factor Blog and built the forensics tool FotoForensics, showed that the signature can be forged, and Google agrees it can be, but says fixing it would mean redesigning the phone.

What Content Credentials promised to prove

C2PA, short for the Coalition for Content Provenance and Authenticity, signs media with a certificate tied to hardware-backed key storage, creating a chain a viewer can check without trusting the platform that hosts the image. In September 2025, Google announced that the Pixel 10 was the first phone to reach the standard's Assurance Level 2, its highest rating, meaning the signing keys live in a dedicated secure chip called StrongBox rather than in ordinary software.

How the Glitter Milk photo passed as real

Krawetz and a colleague, working with a group called PASAWG, reported a theoretical version of the flaw to Google and the C2PA organization in November 2025. In May 2026, independent researcher David Buchanan, known as retr0id, built a working exploit and sent Krawetz a signed forgery: an AI-generated photo of a fictional product called "Glitter Milk," paired with a fabricated news article about unicorn cows, carrying a certificate that said it was captured by a Pixel Camera on May 25, 2026 at 11:04 a.m. Mountain time.

When the image was checked against Adobe's Content Credentials Inspect tool and the Content Authenticity Initiative's own verifier, both returned the same answer: verified, camera-original, Pixel 10 Pro.

Verification tool	Verdict on the forged photo
Adobe Content Credentials Inspect	Verified, attributed to Pixel Camera
Content Authenticity Initiative verifier	Verified

Why Google calls the bug 'Won't Fix'

The forgery requires root access to the phone first, which Buchanan obtained through a one-click tool called Root My Pixel, tracked separately as CVE-2026-43499 and effective even on a fully patched device. From there, the attack exploits what Buchanan's write-up calls a confused-deputy flaw in StrongBox: the secure chip is designed so that only the phone's trusted camera software should submit data for it to sign, but its interface has no way to check who is actually asking. "As root, they can ask StrongBox to use these keys to sign whatever data they like," Buchanan wrote, without needing to extract the key material itself. Signing a forged file took about two minutes from start to finish.

Google closed Krawetz and Buchanan's bug report on July 14 as "Won't Fix (Infeasible)," telling them a real fix would require redesigning the secure hardware in devices already sold. It paid Buchanan a $7,500 bounty through its Vulnerability Reward Program anyway and revoked the specific certificate used to sign the Glitter Milk photo, though it cannot revoke certificates faster than new forged ones could be produced at scale. No CVE was assigned to the signing flaw itself. Krawetz published the full write-up on Aug. 25, roughly 90 days after the working exploit was first demonstrated; the C2PA organization, he said, never responded to the disclosure at all.

What it means for photo authenticity claims

The flaw is not unique to Google's implementation. Krawetz's post argues it applies to any C2PA signer that puts the certificate check downstream of a device an attacker can root, which covers other Android C2PA cameras built the same way. Apple took a visibly different approach when it announced Reference Image on Sept. 15 for the iPhone 18 Pro: rather than attaching provenance metadata after capture the way C2PA does, Apple signs pixel data at the sensor before the image file exists at all and verifies the rest of the pipeline through its Private Cloud Compute infrastructure, a design Apple's own announcement says is meant to avoid exactly the after-the-fact trust problem Krawetz demonstrated.

Neither Google nor the C2PA organization has said whether Assurance Level 2 will be revised, or whether Pixel 10 owners should expect the rating to be withdrawn. Until a validator checks certificate revocation status by default, which most do not today according to Krawetz, a Pixel photo carrying a "Captured with a camera" label is not proof of anything a reader can rely on. The Terminal has covered a separate dispute over the origins of Google's Artemis code and a critical Adobe Commerce zero-day that was already under attack before a fix shipped, a reminder that a vendor calling something fixed and a flaw actually being closed are not always the same claim.