On 2026-05-13, Google Project Zero published "A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens," documenting a two-stage attack chain that roots a Pixel 10 (Tensor G5) device without any user interaction.

Stage one reuses the zero-click Dolby Digital Plus (DD+) Unified Decoder vulnerability (CVE-2025-54957), originally demonstrated against Pixel 9 in Project Zero's January 2026 two-part writeup ("Decoding Dolby" / "Cracking the Sandbox with a Big Wave"). CVE-2025-54957 is an integer wraparound (CWE-190) in evo_priv.c's EMDF payload-size calculation, producing an undersized skip-buffer allocation and a controlled out-of-bounds write (CWE-787). Because Android Messages auto-decodes incoming RCS/MMS audio attachments via the Dolby decoder with no user interaction, a malicious audio message delivers code execution inside the SELinux-sandboxed mediacodec process. To port the Pixel 9 exploit to Pixel 10, the researchers updated memory offsets and, because Pixel 10 enforces RET PAC (pointer authentication on return addresses) where Pixel 9 relied on stack-protector, retargeted the corruption primitive to overwrite the dap_cpdp_init function pointer instead of __stack_chk_fail — defeating the additional mitigation in roughly a day of adaptation work.

Stage two is the newly disclosed privilege escalation: the VPU (video processing unit) driver's IOCTL handler vpu_mmap (bug 463438263 / Android tracker A-463674877, later assigned CVE-2026-0106) calls remap_pfn_range using only the caller-supplied VMA size rather than validating it against the true MMIO register-region size. By requesting an mmap() larger than the VPU's register window, a caller inside the mediacodec sandbox can map arbitrary adjacent physical memory — including the kernel image, which the Pixel bootloader decompresses at the fixed physical address 0x80010000 on every boot — directly into userland. Because Android's arm64 linear map is deliberately left unrandomized (to support up to 256GB of hypothetical memory hot-plug) and its virtual address is a static function of PHYS_OFFSET (phys_to_virt(x) = ((x) - 0x80000000) | 0xffffff8000000000), the attacker can compute the kernel's virtual base without leaking the KASLR slide, a technique Project Zero detailed separately in "Defeating KASLR by Doing Nothing at All" (2025-11-03). The researchers stated the resulting exploit required about 5 lines of code and under a day to develop, and Android's VRP rated it High severity — an escalation from the Moderate rating given the earlier, architecturally similar BigWave driver bug. Unlike a conventional Android camera/media driver, the VPU driver exposes the Wave677DV register interface directly to userspace at /dev/vpu without routing through the V4L2 media framework's normal bounds-checked buffer/memory-mapping layer, which is what let the missing check in vpu_mmap go undetected. Third-party vulnerability trackers (SentinelOne, AppSecure) independently catalog CVE-2026-0106 as a critical, no-user-interaction local elevation-of-privilege issue with a CVSS 3.1 base score of 9.3, corroborating Project Zero's High/root-equivalent severity assessment.

The VPU driver bug shares development lineage with the /dev/bigwave AV1 hardware-decode driver exploited in the Pixel 9 chain (CVE-2025-36934): both drivers wrap the Chips&Media Wave-series video-accelerator IP present on Tensor SoCs and are intentionally exposed to the restricted mediacodec SELinux context so hardware media decoding can be sandboxed. CVE-2025-36934 was a use-after-free race: the BIGO_IOCX_PROCESS ioctl waits up to 16 seconds for bigo_worker_thread to finish a job, but if enough jobs are queued ahead of the target, userland times out and closes /dev/bigwave's file descriptor while the worker thread is still running -- freeing the inst structure (which inline-embeds the job object) while bigo_worker_thread still holds a reference. The attacker reclaims that freed memory by spraying attacker-controlled kmalloc allocations (e.g., via Unix Domain Socket messages) to control the recovered job->regs pointer; when execution reaches bigo_pull_regs(), its memcpy_fromio(regs, core->base, core->regs_size) call writes the BigWave processor's register state through the corrupted pointer, giving a roughly 2144-byte arbitrary kernel write with no KASLR leak required.

That "no leak required" property comes from a separate primitive Project Zero detailed in "Defeating KASLR by Doing Nothing at All" (2025-11-03): because the ARM64 linear map's virtual base (0xffffff8000000000) and the Pixel bootloader's kernel decompression physical address (0x80010000) are both static, an attacker can read a target symbol's kernel-base offset from /proc/kallsyms and compute its absolute virtual address directly, without ever leaking the KASLR slide. In the Pixel 9 chain this is used to locate the modprobe_path kernel variable so the arbitrary-write primitive can overwrite it with an attacker-controlled path, causing the kernel's request_module() fallback to execute an attacker-supplied binary as root -- turning the BigWave arbitrary write into full root code execution.

CVE-2025-54957 (Dolby DD+/UDC) was fixed for Pixel and broader Android in the January 2026 Android Security Bulletin (SPL 2026-01-05), alongside CVE-2025-36934 (BigWave). CVE-2026-0106 (VPU driver) was fixed in the February 2026 Pixel Update Bulletin (SPL 2026-02-05), 71 days after the 2025-11-24 VRP report. This is a disclosed-and-patched research finding — Project Zero found no evidence of in-the-wild exploitation of either link in the chain — but it is tracked here for its zero-click chaining methodology (sandbox-exposed hardware-accelerator drivers + unrandomized ARM64 linear mapping) against Tensor-based Android devices, which is directly reusable against any future driver with the same missing-bounds-check pattern.