A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens

What Happened

Security researchers at Google's Project Zero demonstrated a 'zero-click' attack against the Google Pixel 10 smartphone. By combining a previously known media processing bug with a newly discovered flaw in the phone's video processing chip, they were able to take complete control of the device without any user interaction. This highlights the ongoing need for rigorous security testing in device drivers. Users should ensure their Pixel devices are updated to the February 2026 security patch or later to protect against this vulnerability.

Key Takeaways

• Researchers successfully ported a 0-click exploit chain to the Pixel 10 by combining an updated Dolby vulnerability (CVE-2025-54957) with a new VPU driver flaw.
• The Pixel 10 VPU driver (/dev/vpu) contained a trivial unbounded mmap vulnerability allowing arbitrary physical memory access.
• Exploitation of the VPU bug is highly reliable because the kernel resides at a fixed physical address on Pixel devices.
• The VPU vulnerability was patched in the February 2026 Pixel security bulletin, 71 days after being reported.

Affected Systems

• Google Pixel 10 (unpatched, SPL December 2025 or earlier)
• Android

Vulnerabilities (CVEs)

• CVE-2025-54957

Attack Chain

The attack initiates via a 0-click vector exploiting CVE-2025-54957 in the Dolby UDC library, bypassing RET PAC by overwriting the dap_cpdp_init initialization function. Once initial code execution is achieved, the exploit targets the /dev/vpu driver for the Chips&Media Wave677DV silicon. By issuing an mmap syscall with a size larger than the VPU register region, the attacker exploits an unbounded remap_pfn_range call to map the kernel's physical memory into userspace. This grants arbitrary kernel read/write capabilities, leading to full root privilege escalation.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules or queries are provided in the article.

Detection Engineering Assessment

EDR Visibility: Low — Mobile device exploitation (Android) typically lacks the deep EDR telemetry available on traditional endpoints, especially for kernel-level driver exploitation. Network Visibility: None — The exploit chain operates entirely locally on the device via media parsing and local driver interaction. Detection Difficulty: Hard — Detecting 0-click media parsing exploits and kernel memory mapping abuse requires deep system-level telemetry that is rarely exposed or monitored on mobile devices.

Required Log Sources

• Android logcat
• Kernel audit logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for anomalous or excessively large memory mapping requests originating from untrusted applications targeting the /dev/vpu device node.	Kernel audit logs, syscall monitoring	Privilege Escalation	Low

Control Gaps

• Lack of bounds checking in VPU driver mmap handler
• Fixed physical kernel address on Pixel devices facilitating reliable exploitation

Key Behavioral Indicators

• Unexpected processes interacting with /dev/vpu
• Overwriting of dap_cpdp_init during Dolby UDC initialization

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• Ensure all corporate-managed Google Pixel devices are updated to the February 2026 Android Security Bulletin or later.

Infrastructure Hardening

• Evaluate Mobile Device Management (MDM) policies to enforce minimum OS version requirements for device access to corporate resources.

User Protection

• Consider implementing mobile threat defense (MTD) solutions to monitor for signs of device compromise or rooting.

Security Awareness

• Educate users on the importance of applying mobile device updates promptly, especially to protect against zero-click vulnerabilities.

MITRE ATT&CK Mapping

• T1203 - Exploitation for Client Execution
• T1068 - Exploitation for Privilege Escalation