Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesVicOne and Trend Micro’s Zero Day Initiative (ZDI) co-hosted Pwn2Own Automotive 2026 in Tokyo on January 21–23. The completed contest reported 76 unique zero-day vulnerabilities across 73 attempts, and Fuzzware.io won Master of Pwn with 28 points. Those results concern demonstrations against specific contest targets—not every vehicle or charger of the same type.
What was Pwn2Own Automotive 2026?
Pwn2Own Automotive is a vulnerability research contest focused on automotive-related technology. VicOne and Trend Micro’s ZDI co-hosted the 2026 edition during Automotive World in Tokyo from January 21 through 23. Tesla and Alpitronic were identified as title sponsors in the organizers’ event materials.
As an Amazon Associate I earn from qualifying purchases.
VicOne advertised more than US$1 million in cash and prizes before the event. That was the announced prize pool, not a final accounting of how much was awarded. VicOne’s 2026 event page describes the event and its advance framing.
What did researchers target?
The 2026 rules defined six categories spanning vehicle systems, charging equipment, charging standards, and automotive software. The categories indicate the scope of the contest; they are not a ranking of product safety.
#1 Best Overall
| Category | Scope |
|---|---|
| Tesla | Tesla contest targets |
| In-Vehicle Infotainment (IVI) | In-vehicle infotainment systems |
| Level 3 EV Chargers | Commercial charging equipment |
| Level 2 EV Chargers | Home charging equipment |
| Open Charge Alliance | Technology associated with the charging alliance |
| Operating Systems | Automotive operating systems |
The official ZDI schedule named the Kenwood DNR1007XR as an IVI target. That identifies a contest device; it does not establish that the model is unsafe in ordinary use or support a buying recommendation. The ZDI schedule lists the target and event schedule.
How did the contest work?
Under the 2026 rules, an entry had to compromise a selected target and demonstrate arbitrary code execution or retrieve sensitive information as defined by the sponsor during registration. The sponsor also reserved the right to change the target-device list if circumstances such as release, recall, unavailability, or end-of-life affected a device.
Participation was subject to eligibility requirements and required an in-person demonstration and a Trend ZDI Researcher account. The registration deadline was January 15, 2026, at 5 p.m. Japan Standard Time. These were rules for the now-completed 2026 edition, not open registration instructions. The official rules set out the edition’s requirements.
What were the final results?
VicOne’s final recap reported 76 unique zero-day vulnerabilities across 73 attempts. Fuzzware.io earned 28 Master of Pwn points and was named Master of Pwn 2026. The recap describes successful and colliding attempts involving infotainment devices and home and commercial EV chargers. These figures and demonstrations reflect the contest’s reported entries and targets; they do not establish that all products in those categories share the same vulnerabilities.
See VicOne’s final results recap for the organizer’s account.
What the organizers said
Max Cheng, VicOne’s chief executive, said the contest helps researchers uncover unknown, unpublished, and unreported vulnerabilities so risks can be identified and mitigated earlier in the automotive industry. Brian Gorenc, Trend Micro vice president of threat research and ZDI program leader, described the collaboration as a way to demonstrate the organizations’ security research expertise in automotive technology. These are statements of the organizers’ aims, not independent assessments of the event’s impact. VicOne’s event page carries both statements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the results mean for drivers and vehicle owners
A contest demonstration shows what researchers achieved against a defined target under contest rules. It does not, by itself, prove that every vehicle, stereo, or charger of that kind is vulnerable, or that the demonstration applies to products in everyday configurations. The event results also do not provide consumer-specific mitigation instructions. Owners seeking advice about a particular product should use its manufacturer’s security notices and support channels.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
