Project Zero Reveals Zero-Click-to-Root Exploit Chain for Pixel 10

Google Project Zero disclosed a zero-click exploit chain for unpatched Pixel 10 devices that achieved full root compromise by combining a Dolby Media Framework remote code execution path with a privilege-escalation flaw in the Tensor G5 /dev/vpu driver. The chain adapted an earlier Pixel 9 technique built around CVE-2025-54957, but required changes for Pixel 10, including a different approach to bypass protections such as Return Address Pointer Authentication by targeting dap_cpdp_init instead of the older __stack_chk_fail overwrite method.

The local privilege-escalation bug was found in the Chips&Media Wave677DV VPU driver’s mmap handler, which failed to properly limit mappings to the MMIO register region and allowed userspace to map arbitrary physical memory, including kernel memory, through remap_pfn_range. Researchers said the flaw enabled arbitrary kernel read/write and kernel code execution because Pixel devices exposed the kernel at a predictable physical address. Google received the report on 2025-11-24, rated it High severity under Android VRP, and patched it 71 days later in the February Pixel security bulletin, while the disclosure renewed criticism of recurring shallow security flaws in Android drivers tied to the same developers behind earlier BigWave issues.