In a striking demonstration of Android's ongoing vulnerabilities, Google Project Zero has unveiled a 0-click exploit chain for the Pixel 10, using a previously patched Dolby vulnerability to gain root access without any user interaction.
The exploit chain, which builds on the earlier findings for the Pixel 9, highlights a concerning trend in mobile security: even as patches are rolled out, attackers can adapt and exploit similar vulnerabilities in newer devices. The Dolby 0-click vulnerability, which was patched in January 2026, serves as a reminder that the cat-and-mouse game between security researchers and malicious actors is far from over.
The exploit process began with the adaptation of the Dolby vulnerability (CVE-2025-54957) to the Pixel 10. The researchers found that most of the work involved recalibrating offsets for the specific library version used in the Pixel 10. However, the introduction of RET PAC (Return Address Protection) in the Pixel 10 complicated matters slightly. This security feature prevents certain types of stack overflow attacks by making it harder to overwrite return addresses. The researchers cleverly sidestepped this by targeting the initialization code of the decoder, dap_cpdp_init, which could be overwritten without disrupting functionality.
- 0-click exploits remain a significant threat to user privacy.
- Security patches may not be enough to close all vulnerabilities.
- The adaptability of exploits signals a need for more strong security controls.
The mechanics of the exploit
The exploit chain begins with the initial 0-click vulnerability, allowing an attacker to execute code without any user interaction. In this case, the Dolby vulnerability was the key entry point. Once the attacker gained access, they could manipulate the system by exploiting the library's offsets, which were recalibrated for the Pixel 10. This adaptability is alarming; it shows how quickly attackers can pivot to target newer devices, even when previous vulnerabilities have been patched.
What this means for Android security
The implications of this exploit chain extend beyond just the Pixel 10. It raises questions about the overall security architecture of Android devices. If vulnerabilities can be so easily adapted, it suggests that the underlying framework may have systemic weaknesses that need addressing. The reliance on patching alone is insufficient; manufacturers need to rethink their approach to security, especially as new features and functionalities are introduced.
As we continue to see these types of vulnerabilities emerge, it’s clear that the security landscape for mobile devices is fraught with challenges. The Pixel 10 exploit serves as a stark reminder that security is not a one-time fix but an ongoing battle. Users and manufacturers alike has to stay alert and proactive in addressing these vulnerabilities.
First reported by Google Project Zero.