Google Pixel 10 Zero-Click Exploit Chain Discovered by Project Zero

A 0-click exploit chain for the Pixel 10 has been discovered, allowing attackers to gain root access on Android devices without any user interaction.

Understanding the Attack Vector

The exploit chain, published by Google Project Zero, demonstrates how an attacker can exploit vulnerabilities in the Dolby library to gain control over the device. The Dolby 0-click vulnerability, which existed across all Android devices, was patched in January 2026. However, the researchers were able to update the exploit to work on the Pixel 10 by adjusting the offsets calculated for the specific version of the library.

Technical Details

The exploit involves using the RET PAC mechanism, which replaces the -fstack-protector mechanism used in previous Android versions. This made it challenging for the researchers to update the exploit, as they had to find alternative methods to bypass the security mechanisms.

According to the Google Project Zero researchers, the experience of finding, reporting, and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem, including the need for better documentation and testing of audio-related components.

Who Is Affected

The exploit affects Google Pixel 10 devices, as well as potentially other Android devices that use the Dolby library. However, the exact scope of affected devices is not clear, and users are advised to check with their device manufacturers for updates and patches.

What the Sceptics Say

Some sceptics may argue that the exploit is not a significant concern, as it has already been patched and the Pixel 10 is a relatively new device. However, others may point out that the exploit highlights the ongoing risks associated with 0-click attacks and the need for continued vigilance and security research.

How to Defend

• Keep Android devices and apps up to date with the latest security patches.
• Use a reputable security app to scan for and detect potential vulnerabilities.
• Be cautious when clicking on links or opening attachments from unknown sources.
• Consider using a MITRE ATT&CK-based security framework to identify and mitigate potential attack vectors.

Key Takeaways

1. Security Teams: Prioritize patching and updating Android devices, and consider implementing additional security measures such as SELinux and stack protection.
2. CISOs: Ensure that mobile device security is integrated into the overall security strategy, and that employees are aware of the risks associated with 0-click attacks.
3. Developers: Consider using secure coding practices, such as address space layout randomization (ASLR) and data execution prevention (DEP), to reduce the risk of vulnerabilities.
4. End Users: Keep devices and apps up to date, and be cautious when interacting with unknown sources or clicking on links.

Sources

• Google Project Zero: A 0-click exploit chain for the Pixel 10
• Google Project Zero: A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
• Google Project Zero: A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave
• Google Project Zero: A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby