Pwn2Own is a computer hacking contest, typically held in conjunction with a security conferences (originally CanSecWest security conference). First held in April 2007 in Vancouver, the contest is now held two to three times a year, most recently in September 2026. Contestants are challenged to exploit widely used software and mobile devices with previously unknown vulnerabilities. Winners of the contest receive the device that they exploited and a cash prize. The Pwn2Own contest serves to demonstrate the vulnerability of devices and software in widespread use while also providing a checkpoint on the progress made in security since the previous year. The contest was conceived by Dragos Ruiu and initially intended to highlight the insecurity of Apple's Mac OS X operating system. Its name is derived from the fact that contestants must "pwn" or hack the device in order to "own" or win it.
History
Origins The first contest in 2007 was conceived and developed by Dragos Ruiu in response to his frustration with Apple Inc.'s lack of response to the Month of Apple Bugs and the Month of Kernel Bugs, as well as Apple's television commercials that trivialized the security built into the competing Windows operating system. At the time, there was a widespread belief that, despite these public displays of vulnerabilities in Apple products, OS X was significantly more secure than any other competitors. On March 20, roughly three weeks before CanSecWest that year, Ruiu announced the Pwn2Own contest to security researchers on the DailyDave mailing list. The contest was to include two MacBook Pros that he would leave on the conference floor hooked up to their own wireless access point. Any conference attendee that could connect to this wireless access point and exploit one of the devices would be able to leave the conference with that laptop. There was no monetary reward. The name "Pwn2Own" was derived from the fact that contestants must "pwn" or hack the device in order to "own" or win it.
On the first day of the conference in Vancouver, British Columbia, Ruiu asked Terri Forslof of the Zero Day Initiative (ZDI) to participate in the contest. ZDI has a program which purchases zero-day attacks, reports them to the affected vendor and turns them into signatures for their own network intrusion detection system, increasing its effectiveness. The vulnerabilities sold to ZDI are made public only after the affected vendor has issued a patch for it. Forslof agreed to have ZDI offer to purchase any vulnerabilities used in the contest for a flat price of $10,000. The first contest subsequently exposed a high-profile QuickTime flaw, which was disclosed to Apple on April 23 and patched in early May.
In 2008 the scope of the Pwn2Own contest was expanded. Targets included three laptops running the default installation of Windows Vista, OS X, or Ubuntu Linux. Mobile devices were added in 2009.
For 2012 the rules were changed to a capture-the-flag-style competition with a point system. At and Chrome was successfully exploited for the first time, by regular competitor VUPEN. After withdrawing from the contest that year due to new disclosure rules, in 2013 Google returned as a sponsor and the rules were changed to require full disclosure of exploits and techniques used. In that year (2013) a single researcher was able to hack Chrome, Firefox and Internet Explorer, a trifecta hack. Google ceased to be a sponsor of Pwn2Own in 2015.
Recent years In 2015, every web browser tested was successfully hacked and every prize won, totaling $557,500. Other prizes such as laptops were also given to winning researchers. In 2018, the conference was much smaller and sponsored primarily by Microsoft, after China banned its security researchers from participating in the contest.
Pwn2Own continues to be sponsored by Trend Micro's Zero Day Initiative, with ZDI reporting vulnerabilities to vendors before going public with the hacks. "One of the largest hacking contests in the world" according to TechCrunch, the contest continues to be held several times a year. Pwn2Own Tokyo was held November 6 to November 7 in Tokyo, Japan, and was expected to hand out $750,000 in cash and prizes. Hacks focus on browsers, virtual machines, computers, and phones. In 2019, the contest added cars for the first time, with $900,000 offered for hacks exploiting Tesla software. In 2019, the contest added industrial control systems. The 2025, Pwn2Own event was hosted at OffensiveCon in Berlin, as is the 2026 event.
Award system
Winners of the contest receive the device that they exploited and a cash prize. Winners also receive a "Masters" jacket celebrating the year of their win.
List of successful exploits
The following list of notable hacks is incomplete. Hacker(s) Affiliation Year Exploit Target Version / OS Source Dino Dai Zovi Independent 2007 QuickTime (Safari) Mac OS X Shane Macauley Independent 2007 QuickTime (Safari) Mac OS X Charlie Miller ISE 2008 Safari (PCRE) Mac OS X 10.5.2 Jake Honoroff ISE 2008 Safari (PCRE) Mac OS X 10.5.2 Mark Daniel ISE 2008 Safari (PCRE) Mac OS X 10.5.2 Shane Macauley Independent 2008 Adobe Flash (Internet Explorer) Windows Vista Service Pack 1 Alexander Sotirov Independent 2008 Adobe Flash (Internet Explorer) Windows Vista Service Pack 1 Derek Callaway Independent 2008 Adobe Flash (Internet Explorer) Windows Vista Service Pack 1 Charlie Miller ISE 2009 Safari Mac OS X Nils Independent 2009 Internet Explorer 8 Windows 7 Beta Nils Independent 2009 Safari Mac OS X Nils Independent 2009 Mozilla Firefox Charlie Miller ISE 2010 Safari Mac OS X Peter Vreugdenhil Independent 2010 Internet Explorer 8 Windows 7 Nils Independent 2010 Mozilla Firefox 3.6 Windows 7 (64-bit) Ralf-Philipp Weinmann Independent 2010 iPhone 3GS iOS Vincenzo Iozzo Independent 2010 iPhone 3GS iOS VUPEN VUPEN 2011 Safari 5.0.3 Mac OS X 10.6.6 Stephen Fewer Harmony Security 2011 Internet Explorer 8 (32-bit) Windows 7 Service Pack 1 (64-bit) Charlie Miller ISE 2011 iPhone 4 iOS 4.2.1 Dion Blazakis ISE 2011 iPhone 4 iOS 4.2.1 Willem Pinckaers Independent 2011 BlackBerry Torch 9800 BlackBerry OS 6.0.0.246 Vincenzo Iozzo Independent 2011 Blackberry Torch 9800 BlackBerry OS 6.0.0.246 Ralf-Philipp Weinmann Independent 2011 Blackberry Torch 9800 BlackBerry OS 6.0.0.246 VUPEN VUPEN 2012 Chrome Windows 7 Service Pack 1 (64-bit) VUPEN VUPEN 2012 Internet Explorer 9 Windows 7 Willem Pinckaers Independent 2012 Mozilla Firefox Vincenzo Iozzo Independent 2012 Mozilla Firefox Nils, Jon, Tyrone Erasmus, Jacques Louw MWR Labs 2012 Samsung Galaxy S3 Android VUPEN VUPEN 2013 Internet Explorer 10 Windows 8 VUPEN VUPEN 2013 Adobe Flash Windows 8 VUPEN VUPEN 2013 Oracle Java Windows 8 Nils MWR Labs 2013 Chrome Windows 8 Jon MWR Labs 2013 Chrome Windows 8 George Hotz Independent 2013 Adobe Reader Windows 8 Joshua Drake Independent 2013 Oracle Java Windows 8 James Forshaw Independent 2013 Oracle Java Windows 8 Ben Murphy Independent 2013 Oracle Java Windows 8 Pinkie Pie Independent 2013 (Mobile) Chrome Android Nico Joly VUPEN 2014 (mobile) Windows Phone (Internet Explorer 11) Windows 8.1 VUPEN VUPEN 2014 Internet Explorer 11 Windows 8.1 VUPEN VUPEN 2014 Adobe Reader XIWindows 8.1 VUPEN VUPEN 2014 Chrome Windows 8.1 VUPEN VUPEN 2014 Adobe Flash Windows 8.1 VUPEN VUPEN 2014 Mozilla Firefox Windows 8.1 Liang Chen, Zeguang Zhao Keen team, team509 2014 Adobe Flash Windows 8.1 Sebastian Apelt, Andreas Schmidt Independent 2014 Internet Explorer 11 Windows 8.1 Jüri Aedla Independent 2014 Mozilla Firefox Windows 8.1 Mariusz Młyński Independent 2014 Mozilla Firefox Windows 8.1 George Hotz Independent 2014 Mozilla Firefox Windows 8.1 Liang Chen, Zeguang Zhao Keen team, team509 2014 OS X Mavericks, and Safari Bernard Wagner, Kyle Riley MWR Labs 2014 Amazon Fire Phone Fire OS Jung Hoon Lee, aka lokihardt Independent 2015 Internet Explorer 11, Google Chrome, and Safari Nico Golde, Daniel Komaromy Independent 2015 (Mobile) Samsung Galaxy S6 Baseband Android Guang Gong Qihoo 360 2015 (Mobile) Nexus 6 Chrome Android JungHoon Lee Independent 2016 Microsoft Edge Windows 10Liang Chen, Qidan He, Marco Grassi, Yubin FuTencent Security Team Sniper2016SafariMac OS X360VulcanQihoo 3602016Adobe Flash Player, ChromeWindows 10Liang Chen, Wayne Liang, Marco Grassi, Yubin FuTencent Keen Security Lab2016 (Mobile)SafariiOS 10Qidan He, Gengming Liu, Zhen FengTencent Keen Security Lab2016