C2PA Broke on Android. The Patch Won’t Come.

David Buchanan published a technical teardown of C2PA on Android last week and reached a conclusion the Content Authenticity Initiative has not publicly addressed: “C2PA on the Android platform is broken, in a way that cannot be realistically patched.” The mechanism is CVE-2026-43499, a one-click root exploit for fully-patched Google Pixel devices that exists in the wild. With root, Buchanan demonstrated that a tool called Keystork — which impersonates arbitrary apps and invokes arbitrary KeyStore API operations — can forge valid C2PA signatures for any photo without extracting a single hardware key from the device. The resulting signatures pass verification. A C2PA-aware newsroom, a regulatory compliance tool, a platform checking content credentials — all of them see a legitimate certificate chain and a valid manifest. There is nothing in the C2PA verification flow that detects a Keystork-generated signature.

The day Buchanan’s post crested on Hacker News, a parallel reverse-engineering effort documented a different failure in the same infrastructure. MS Paint’s “local” AI generation on Copilot+ PCs — marketed as on-device computation — silently calls Microsoft’s servers before each image. The server returns a 16-byte GUID unique to that moderation session. The GUID gets embedded invisibly into the generated image’s pixels using block-based quantization across roughly 193,376 pixel locations. It is designed to survive compression. It links the image permanently to the prompt moderation record. It is the `c2pa.soft-binding.value` in the image’s Content Credentials. It was not prominently disclosed in Microsoft’s feature documentation.

Two different failures, two different companies, one week. The provenance stack the content industry has spent three years building is under scrutiny, and the results are not good.

What the Stack Is Supposed to Prove

C2PA’s trust model is built around signer identity. The specification is direct about this: “the basis of making trust decisions in C2PA…is the identity of the signer associated with the cryptographic signing key used to sign the claim(s).” A valid C2PA manifest proves that a specific cryptographic key signed specific claims about an asset, and that the manifest hasn’t been tampered with since signing. It does not prove the claims are true. The spec says so: “C2PA specifications SHOULD NOT provide value judgments about whether a given set of provenance data is ‘good’ or ‘bad.'”

The Content Authenticity Initiative acknowledges this in its documentation: Content Credentials “aren’t intended to prescriptively indicate whether a piece of content is ‘real.'” The CAI describes them as “a nutrition label for digital content” — context for informed judgment, not a certificate of truth.

That framing, buried in the technical documentation, competes with the CAI’s public positioning. The initiative describes itself as “dedicated to addressing the prevalence of misleading information online through the development of technical standards for certifying the source and history of media content.” The word is “certifying.” The Adobe-Google-Microsoft-Reuters coalition has sold C2PA to newsrooms, camera manufacturers, chip vendors, and regulators as the technical answer to synthetic media. The understanding in the room — whatever the spec says — is that C2PA-verified content earns a level of trust that unverified content does not, and that trust comes from hardware-bound cryptographic keys that cannot be forged without access to the device’s secure element. That is the premise CVE-2026-43499 removes on Android.

The Root That Breaks the Chain

Android’s C2PA implementation uses Android Key Attestation or Google Play Integrity to bind signing keys to hardware. Key Attestation works by having the device’s StrongBox security chip certify — in an attestation certificate chain that terminates at a Google root of trust — that a given cryptographic key was generated inside hardware and has never left it. A C2PA camera app on Android holds a private key inside StrongBox. When it signs a content manifest, the signature carries an attestation certificate chain proving the signing key is hardware-bound. A verifier walks the chain, checks Google’s root certificate, and concludes the signature came from an unmodified device running Google-attested software. The signing key never moves, never appears in software memory, and cannot be duplicated.

All of this is true when the device’s software stack is uncompromised. The moment an attacker has root, the guarantee collapses — not because the key moves, but because root enables impersonating the app entirely. Keystork is a client/server tool that, once root is established, can invoke arbitrary KeyStore API operations while presenting as any installed app. The C2PA camera app’s key stays in StrongBox. Keystork simply asks StrongBox to sign arbitrary content on behalf of that app. The resulting signatures are valid because the key is valid, the app identity is valid, and the attestation chain reflects a legitimate device state at enrollment time. Nothing downstream detects the impersonation.

Play Integrity, the other Android attestation mechanism in common use, has the same architecture and the same vulnerability. Both are software-layer trust checks; both break when the software layer is compromised at root. Buchanan’s scope is not limited to Pixel: “All C2PA camera apps on Android using Android_KeyAttestation or Google_PlayIntegrity are vulnerable, extending beyond Pixel devices to cheaper, more vulnerable Android hardware.” Cheaper devices receive security patches more slowly, sometimes not at all. CVE-2026-43499 affects fully-patched Pixels — devices that get patches the same day Google releases them. Less-maintained hardware is exposed to more vulnerabilities for longer.

The reason Buchanan concludes this cannot be realistically patched is hardware fault injection. Research on DRAM electromagnetic fault injection has demonstrated root on mobile devices without any software exploit — by inducing bit flips in memory at the hardware level. A software patch addresses CVE-2026-43499; it does not address the attack class. The trust model for Android Key Attestation requires an assumption — uncompromised software stack — that Android’s security history shows is not a durable long-term premise for a platform running across billions of devices and an unbounded ecosystem of vendors, carriers, and update schedules.

The Other Kind of Failure

The MS Paint finding is a different failure, but in the same category of problem: a gap between what provenance infrastructure is understood to guarantee and what it actually does.

Microsoft markets AI image generation in Paint and Photos on Copilot+ PCs as a local-inference feature. The neural network runs on the device’s NPU — no cloud inference. That framing is accurate for the generation step. The reverse engineering by Xu Sheng shows the control layer is not local at all. Before the NPU generates a pixel, Paint sends the user’s prompt to a Microsoft content-moderation endpoint: apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net/v1/paint-cocreator/moderate-prompt. The server returns a `revisedPrompt` (possibly edited), a `promptGenerationId`, and a `watermarkId` — a fresh 16-byte GUID for this moderation session. The GUID is then embedded into the generated image across roughly 193,376 pixel locations using a block-based quantization algorithm with SVD-style decomposition. It is designed to be invisible and to survive standard image processing.

The GUID surfaces in the image’s C2PA Content Credentials as c2pa.soft-binding.value. Microsoft can correlate any generated image with its prompt moderation session through this identifier. There is no offline mode — genuine offline generation is unavailable even on Copilot+ hardware. MS Paint treats watermarking failure as generation failure and refuses to return an unmarked image; MS Photos logs failures but returns the image anyway, creating inconsistent behavior between the two applications. Export is restricted to PNG, JPEG, GIF, and Paint’s own format — BMP is excluded because it would strip C2PA credentials.

The problem is not that Microsoft runs server-side moderation — that’s a defensible policy. The problem is disclosure. The GUID and the server-issued watermark are not described in Paint’s feature documentation in any way that would lead a user to understand their generated images carry a permanent server-issued identifier linking the image to their prompt. The “local AI” framing, technically accurate for inference, systematically obscures where identification and control actually happen. Provenance infrastructure and identification infrastructure have different purposes and different implications for users. Running them through the same mechanism without clearly distinguishing them is not a technical limitation — it is a communication choice.

What These Two Failures Share

They are both structural, not accidental. Buchanan’s conclusion — “cannot be realistically patched” — does not mean CVE-2026-43499 will not receive a fix. It means the trust model that Android Key Attestation provides for C2PA is not sound when applied to the actual security posture of Android devices in the wild, where one-click root exploits exist for flagship hardware and hardware-level attacks exist for everything else. The CAI’s answer — C2PA raises the cost of forgery without eliminating it — requires the cost to be meaningfully high. CVE-2026-43499, publicly available, sets the forgery cost on Android at near-zero for anyone motivated to run a tool.

The MS Paint failure doesn’t undermine C2PA’s integrity properties in the same way. The cryptographic signatures are sound. The problem is what the provenance layer is doing beyond its stated purpose. A watermark that functions as a tracking identifier is not wrong in isolation — it is what was built. The gap is between what users are told the system does (“local AI,” “content credentials”) and what the system actually does (server-issued identifiers permanently embedded in pixel data, prompt text transmitted for moderation, correlation possible between image and session). The spec was honest about C2PA’s limits. The deployment was not.

The industry deployed C2PA with a level of assurance it had not earned. The two findings this week are not obscure edge cases — they are examinations of the trust assumptions the whole stack rests on, conducted with publicly available tools, on current production hardware, against current production software. The spec knows what it can prove: signer identity and tamper-evidence, when the signing device is uncompromised and the signing process is honestly disclosed. The marketing said something different. Closing that gap before the next camera generation ships C2PA as a first-line guarantee against synthetic media is not optional. The standard the industry set for itself is not the one it is currently meeting.

AI-generated editorial illustration · TemperatureZero · August 25, 2026