Loading story…
Google Project Zero disclosed a zero-click exploit chain for unpatched Pixel 10 devices that achieved full root compromise by combining a Dolby Media Framework remote code execution path with a privilege-escalation flaw in the Tensor G5 /dev/vpu driver. The chain adapted an earlier Pixel 9 technique built around CVE-2025-54957, but required changes for Pixel 10, including a different approach to bypass protections such as Return Address Pointer Authentication by targeting dap_cpdp_init instead of the older __stack_chk_fail overwrite method.
The local privilege-escalation bug was found in the Chips&Media Wave677DV VPU driver’s mmap handler, which failed to properly limit mappings to the MMIO register region and allowed userspace to map arbitrary physical memory, including kernel memory, through remap_pfn_range. Researchers said the flaw enabled arbitrary kernel read/write and kernel code execution because Pixel devices exposed the kernel at a predictable physical address. Google received the report on 2025-11-24, rated it High severity under Android VRP, and patched it 71 days later in the February Pixel security bulletin, while the disclosure renewed criticism of recurring shallow security flaws in Android drivers tied to the same developers behind earlier BigWave issues.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On May 1, 2026, Google Project Zero published technical details showing how a zero-click exploit chain could compromise unpatched Pixel 10 devices and escalate privileges to root. The disclosure described the adapted Dolby exploit, the new VPU driver flaw, and the security implications for Android driver development.
Google fixed the reported /dev/vpu driver vulnerability 71 days after disclosure in the February 2026 Pixel/Android security bulletin. The patch closed the privilege-escalation path used in the Pixel 10 zero-click-to-root chain.
After receiving the report, Google classified the Pixel 10 /dev/vpu driver vulnerability as a High-severity issue under Android VRP. This reflected the seriousness of the bug's impact on privilege escalation to root.
On November 24, 2025, researchers reported a severe vulnerability in the Pixel 10's /dev/vpu driver for the Chips&Media Wave677DV on Tensor G5. The mmap bug allowed mapping arbitrary physical memory, including kernel memory, into user space, enabling arbitrary kernel read/write and code execution.
Researchers updated a previously published Pixel 9 zero-click-to-root exploit chain for the Pixel 10 by modifying the Dolby Media Framework exploit for CVE-2025-54957 and replacing the prior local privilege escalation component. The new chain accounted for Pixel 10 changes such as RET PAC and the absence of the BigWave driver.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs detailed two exploit chains showing how vulnerabilities in the Arm Mali GPU driver could be turned into full kernel compromise on Google Pixel phones. One write-up analyzed `CVE-2023-6241`, a race condition in `kbase_jit_grow` on a Pixel 8 running Android 14, where stale allocation state after a lock drop left some physical pages backed but unmapped. That inconsistency was used to trigger a page use-after-free, reclaim the freed page, and build arbitrary kernel read/write primitives. The exploit then overwrote kernel code to disable SELinux enforcement and invoked `commit_creds(&init_cred)` to gain root from the unprivileged `untrusted_app_27` context; STAR Labs said excessive `WARN_ON` logging initially stretched exploitation to about 10 minutes before testing reduced runtime to under five seconds. A second write-up showed that `CVE-2023-48409` alone was sufficient to compromise a Pixel 6 Pro, contradicting earlier assumptions that exploitation also required `CVE-2023-26083`. STAR Labs described the bug as an integer-overflow-driven out-of-bounds write in the Pixel Mali driver and said exploitation bypassed `CONFIG_HARDENED_USERCOPY` by targeting page-allocator-backed objects and using pagetable spraying techniques inspired by Dirty Pagetable. The researchers also mapped Android-specific constraints including seccomp, SELinux, and privilege-escalation mechanics, and found that while the earlier pointer-leak bug still existed on affected devices, the practical path relied on leaking a `kbase_context` object exposing a `task_struct` pointer for direct credential manipulation. Both reports said the affected issues were patched in later Android security updates.
Jun 29, 2026
Google released a security update in November 2025 to address a critical remote code execution vulnerability, CVE-2025-48593, in the Android System component. This flaw allows attackers to execute code remotely on affected devices running Android versions 13 through 16 without requiring user interaction or additional execution privileges. The vulnerability stems from insufficient validation of user input, making it possible for exploitation via a zero-click attack vector. The update also addressed a separate privilege escalation issue, CVE-2025-48581, affecting Android 16, but the primary concern is the zero-click RCE, which requires immediate patching due to its severity. Google has stated that there is no evidence of active exploitation in the wild at the time of the update. Security experts urge all users and organizations to apply the November 2025 security patch promptly to mitigate the risk posed by this critical vulnerability.
Jun 29, 2026
A critical zero-click remote code execution (RCE) vulnerability has been discovered in the Dolby Unified Decoder, a widely used audio format processing component present in Android, iOS, and macOS devices. The flaw, tracked as CVE-2025-54957, is a high-severity out-of-bounds write issue that can be exploited by threat actors through maliciously crafted audio messages. According to Google Project Zero researchers Ivan Fratric and Natalie Silvanovich, the vulnerability arises from improper handling of evolution data within the decoder. Specifically, the decoder writes evolution information into a large, heap-like buffer, but a flaw in the length calculation due to integer wrap can result in overwriting later members of the struct, including critical pointers. This memory corruption can be triggered without any user interaction, making it a zero-click attack vector, particularly on Android devices. The vulnerability allows attackers to execute arbitrary code remotely, posing a significant risk to affected systems. Google has responded by releasing patches for ChromeOS to address the issue, demonstrating the cross-platform impact of the vulnerability. Microsoft has also included a fix for the flaw in its latest Patch Tuesday updates, indicating that Windows systems utilizing the Dolby decoder may also be at risk. The vulnerability's zero-click nature means that users could be compromised simply by receiving a malicious audio file, without needing to open or interact with it. Security researchers emphasize the importance of promptly applying available patches to mitigate the risk of exploitation. The discovery highlights the ongoing challenges in securing complex multimedia processing components, which are often integrated into a wide range of consumer and enterprise devices. The flaw's technical details, including the specific buffer overflow mechanism and the potential for pointer overwrites, underscore the sophistication required to both discover and exploit such vulnerabilities. The coordinated disclosure and rapid patching efforts by Google and Microsoft reflect the seriousness of the threat. Organizations are advised to review their exposure to the Dolby Unified Decoder and ensure all relevant updates are applied. The incident serves as a reminder of the critical need for robust security testing in third-party components embedded within operating systems and applications. Ongoing monitoring for exploitation attempts is recommended, as threat actors may attempt to reverse-engineer the patches to develop working exploits. The vulnerability's impact across multiple platforms increases its attractiveness to attackers, making timely remediation essential for both individual users and enterprises.
Jul 12, 2026