Pwn2Own Automotive 2026 Demonstrates Zero-Day Exploits Against Tesla IVI and EV Charging Ecosystem

Security researchers demonstrated dozens of previously unknown vulnerabilities during Pwn2Own Automotive 2026 in Tokyo, including successful compromise of a Tesla infotainment system and multiple EV chargers and in-vehicle infotainment (IVI) products. On day one, researchers earned significant payouts after chaining bugs to achieve root-level access and code execution across targets; reported examples included a USB-based exploit chain against Tesla’s infotainment system to obtain root privileges, plus successful attacks against products from Sony, Kenwood, Alpine, and several EV charging vendors. Under the contest rules, affected vendors receive a 90-day window to produce patches before Trend Micro’s Zero Day Initiative (ZDI) discloses the vulnerabilities.

ZDI’s day-one results detail multiple winning exploit chains and vulnerability classes used against automotive-adjacent systems, including a stack-based buffer overflow yielding a root shell on an Alpine head unit, exploit chains against an Autel charger (including CWE-306 and CWE-347) enabling charging-signal manipulation, a hardcoded credential (CWE-798) leveraged for code execution against the Grizzl-E Smart 40A, and a command injection used against the ChargePoint Home Flex. ZDI’s published schedule for subsequent days shows continued focus on the same target set (e.g., Kenwood DNR1007XR, Sony XAV-9500ES, Phoenix Contact CHARX SEC-3150, Alpitronic HYC50, and Grizzl-E Smart 40A), indicating additional attempts and potential further zero-day disclosures as the competition progresses.