# Pixel 10 VPU Driver mmap Boundary-Check Flaw Enables Root Exploit Chain (CVE-2025-54957)

> Google Project Zero researchers Seth Jenkins and Jann Horn chained a Dolby UDC integer-overflow 0-click RCE (CVE-2025-54957) with a missing boundary-check flaw in the Pixel 10 VPU driver's vpu_mmap() handler to achieve full root/kernel compromise from a malicious audio file, with the kernel privilege-escalation stage requiring only about five lines of exploit code.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1544
- **ID:** TL-2026-1544
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-54957

## Description

In May 2026, Google Project Zero published a detailed writeup of a complete zero-click exploit chain against the Google Pixel 10, developed by researchers Seth Jenkins and Jann Horn. The chain has two stages. Stage one repurposes a previously-known Dolby Unified Decoder (UDC) vulnerability, CVE-2025-54957, an integer-overflow-driven out-of-bounds write (CWE-190/CWE-787) in the parsing of 'evolution' data inside Dolby Digital Plus (DD+) audio bitstreams. A crafted audio file processed automatically by the mediacodec pipeline overflows a length calculation, corrupting memory and allowing code execution inside the mediacodec sandbox with no user interaction. Porting this exploit from earlier Pixel 9 research to Pixel 10 required only recalculating library offsets for the updated Dolby library build, and substituting the classic __stack_chk_fail overwrite (blocked by Return Address Pointer Authentication / RET PAC on Pixel 10) with an overwrite of dap_cpdp_init, a one-shot initialization routine that can be safely hijacked without destabilizing subsequent decoding.

Stage two escalates from the mediacodec sandbox to full kernel/root compromise via a driver design flaw newly introduced on Pixel 10: the /dev/vpu character device backing the Chips&Media Wave677DV video processing unit on the Tensor G5 SoC. The driver's mmap handler, vpu_mmap(), calls remap_pfn_range() using only the caller-supplied VMA length, without validating that the requested mapping stays within the bounds of the VPU's actual MMIO register region. Because Pixel devices do not randomize the kernel's physical load address (no KASLR on the physical mapping) and the VPU register region sits at a fixed, predictable offset below the kernel image in physical memory, an attacker holding the mediacodec-context /dev/vpu file descriptor can request an oversized mmap and directly map arbitrary physical memory, including the kernel's .text and .data sections, into userspace. This yields an arbitrary kernel read/write primitive sufficient for full root privilege escalation, and researchers note the privilege-escalation logic itself required roughly five lines of exploit code and under a day of research effort once the design flaw was identified. Jann Horn found and confirmed the bug during a roughly two-hour audit of the driver.

The VPU driver was authored by the same vendor development team responsible for the earlier, structurally similar BigWave driver vulnerability on Pixel 9, indicating a recurring secure-coding gap in Android video-codec driver development at that vendor. Google rated the VPU bug 'High' severity (an improvement over the initially 'Moderate' rating given to the analogous BigWave bug despite equivalent impact) and patched it in the February 2026 Pixel security bulletin, 71 days after Jenkins' November 24, 2025 report — the first time one of Jenkins' reported Android driver bugs was fixed in under 90 days. Devices at or above the February 2026 Security Patch Level (SPL) are protected; devices at December 2025 SPL or earlier remain exposed to the full zero-click chain if the Dolby-side vulnerability is also unpatched, or exposed to local/sandboxed privilege escalation via the VPU bug alone regardless of the Dolby patch state.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1091 Replication Through Removable Media
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1068 Exploitation for Privilege Escalation
- T1574 Hijack Execution Flow
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1003 OS Credential Dumping
- T1005 Data from Local System
- T1565 Data Manipulation
- T1587 Develop Capabilities
- T1596 Search Open Technical Databases

## Sources

- [A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens](https://projectzero.google/2026/05/pixel-10-exploit.html)
- [Google's Security Team Built a Zero-Click Root Exploit for the Pixel 10](https://www.cyberkendra.com/2026/05/googles-security-team-built-zero-click.html)
- [Google Project Zero Reveals Zero-Click Exploit Chain for Pixel 10](https://cyberpress.org/zero-click-exploit-chain-for-pixel-10/)
- [Google Project Zero Details Pixel 10 Zero-Click Exploit Chain](https://gbhackers.com/pixel-10-zero-click-exploit-chain/)
- [Project Zero's Pixel 10 Zero-Click Exploit Explained](https://byteiota.com/project-zeros-pixel-10-zero-click-exploit-explained/)
- [Pixel Bigwave BigO job_timeout UAF kernel write](https://hacktricks.wiki/en/binary-exploitation/linux-kernel-exploitation/pixel-bigwave-bigo-job-timeout-uaf-kernel-write.html)
- [Google Project Zero Reports Zero-Click Exploit Chain for Pixel 10 Devices](https://beyondmachines.net/event_details/google-project-zero-reports-zero-click-exploit-chain-for-pixel-10-devices-0-y-a-y-b)
- [Google Project Zero Discloses Zero-Click Exploit Chain for Pixel 10 Devices](https://cybersecuritynews.com/zero-click-exploit-chain-pixel-10-devices/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1544