Pwn2Own Automotive 2026 set a new record with 76 unique zero-day vulnerabilities discovered across EV chargers, in-vehicle infotainment systems, and Tesla interfaces. Co-hosted by VicOne and TrendAI Zero Day Initiative in Tokyo, the competition demonstrated three attack surfaces with immediate practical implications for security teams.
For the first time in Pwn2Own history, an NFC tap was used to compromise an EV charger. The Synacktiv team exploited the Autel MaxiCharger AC Elite Home 40A via a stack-based buffer overflow through the NFC interface, achieving code execution that altered the charger’s output behavior. NFC, typically treated as a convenience feature, proved to be an exploitable attack surface when input reaches embedded parsing logic without memory-safety protections.
Hardcoded credentials in EV charger firmware emerged as another critical vector. When credentials are reused across devices or chained with weak update validation, a single compromised charger can cascade into fleet-wide risk. USB interfaces in IVI systems also remain viable attack surfaces when paired with chained memory-safety vulnerabilities.
VicOne recommends security teams treat contactless interfaces with the same validation rigor as network-facing endpoints, implement memory-safe coding practices with compiler-level mitigations, and enforce strict segmentation between convenience features and operational controls.
The findings underscore that the connected vehicle attack surface now extends well beyond the vehicle itself into charging infrastructure and cloud ecosystems.
