Security researcher David Buchanan said Android implementations of C2PA, a media-provenance standard intended to cryptographically identify camera-captured content, can be made to sign arbitrary AI-generated images and videos after a device is rooted. He demonstrated media that C2PA verification identified as originating from Google’s Pixel Camera app and said a YouTube label initially described a forged video as “captured with a camera.” Google later removed that section of the video description, Buchanan said. Android C2PA camera apps rely on Key Attestation or Google Play Integrity to prevent altered apps from signing non-camera data. Buchanan said privilege-escalation exploits can root a device without unlocking its bootloader or modifying its verified boot keys, allowing a compromised but apparently compliant device to obtain C2PA signing keys. StrongBox hardware prevents extraction of those keys, but root access can instruct StrongBox to sign arbitrary data, he said. Buchanan cited CVE-2026-43499 as an in-the-wild one-click root exploit affecting fully patched Pixel devices at the time of publication, August 25, 2026. He also said low-cost hardware fault-injection attacks can root devices and may not be patchable on existing hardware. Google awarded Buchanan a $7,500 bounty despite closing his report as “Won’t fix (infeasible),” according to Buchanan.