Revealing mistake: If you look at the drawing in front of Eddie when he glances down at it after Venom typed in the name of the beach, it's only a crude draft of the one in close-up (it's missing the wave lines below the cliff outline, for instance). (00:11:20)
Revealing mistake: Kasady squishes a spider that is walking on the postcard. The splattered blotch, strictly divided in red and black, is disproportionately large for the size of the insect. (00:25:35)
Revealing mistake: In a random act of road rage, Carnage sticks out a couple of tentacles, effortlessly lifts up a truck that was driving by, and tosses it off the bridge. Great, but no matter how strong Carnage and each tentacle of his is, it can't nullify physics; it lifts that vehicle stopping entirely its momentum, and Carnage's car does not even remotely budge for the added weight. (00:45:25)
Revealing mistake: The back of Cletus Kasady's head appear quite different between the semi-POV shot in the car (stunt driver) and the next shot when Woody Harrelson steps out of it and gets to the gas station where he will 'hack the internets'. (00:49:40)
Revealing mistake: Shriek's scream is strong enough to cause the explosion of a helicopter at great distance, but the frame of the windshield is unscathed. (00:54:15)
Revealing mistake: When Venom violently opens the large portal of the church, he barely takes one step but the doors close basically through him. (01:08:15)
Answer: It is deliberately never shown on screen, so unless it gets answered in a sequel the audience is left to speculate. Mulligan does come into direct contact with Carnage since Cletus is the person who kidnapped him. In addition, the fight between Venom and Carnage takes place all over the church with the pair constantly stabbing, slashing, and bludgeoning each other. A piece of either symbiote could be somewhere in that building. Again, though this is just speculation since it's never shown how Mulligan is infected.
BaconIsMyBFF