Pwn2Own Berlin 2026 Day One Sees 24 Zero Days and $523k in Awards

Pwn2Own Berlin 2026, Day One saw 22 entries targeting browsers, operating systems, AI platforms and NVIDIA infrastructure, with researchers unlocking 24 zero‑days and earning a total of $523,000 in rewards, according to Zero Day Initiative. Orange Tsai of DEVCORE Research Team dominated the day, chaining four logic bugs to escape the Microsoft Edge sandbox and taking home $175,000 and 17.5 Master of Pwn points in a single attempt.

Windows 11 was exploited three times during the day, with each researcher earning $30,000: Angelboy and TwinkleStar03 from the DEVCORE Internship Program, Marcin Wiązowski, and Kentaro Kawane of GMO Cybersecurity. Valentina Palmiotti of IBM X‑Force Offensive Research earned $70,000 across two wins, including $50,000 for an NVIDIA Container Toolkit zero‑day and $20,000 for rooting Red Hat Linux for Workstations.

In the AI domain, k3vg3n claimed $40,000 for taking down LiteLLM, while Compass Security and maitai of Doyensec each secured $40,000 for exploiting OpenAI’s Codex, and STARLabs SG earned $40,000 for a zero‑day in LM Studio. The full prize pool across all categories is set to exceed $1,000,000, with day two targets including Microsoft and Apple products among others.