# Zero-click Pixel 10 exploit chain: VPU driver mmap flaw (CVE-2026-0106) enables arbitrary kernel read/write, chained with Dolby decoder RCE (CVE-2025-54957)

> Google Project Zero researchers Seth Jenkins and Jann Horn disclosed a zero-click exploit chain rooting Pixel 10 (Tensor G5) devices: a missing bounds check in the VPU driver's vpu_mmap handler (CVE-2026-0106) lets an unprivileged caller map the entire kernel image into userland via an oversized mmap(), yielding arbitrary kernel read/write. Chained with a Pixel-10-adapted version of the Dolby DD+ decoder zero-click RCE (CVE-2025-54957) that first gains code execution in the mediacodec sandbox from a malicious RCS/MMS audio message, the pair achieves fully remote, zero-click root with no user interaction.

- **Published:** 2026-09-09T00:00:00Z
- **Last reviewed:** 2026-09-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2418
- **ID:** TL-2026-2418
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-54957, CVE-2025-36934, CVE-2026-0106

## Description

On 2026-05-13, Google Project Zero published "A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens," documenting a two-stage attack chain that roots a Pixel 10 (Tensor G5) device without any user interaction.

Stage one reuses the zero-click Dolby Digital Plus (DD+) Unified Decoder vulnerability (CVE-2025-54957), originally demonstrated against Pixel 9 in Project Zero's January 2026 two-part writeup ("Decoding Dolby" / "Cracking the Sandbox with a Big Wave"). CVE-2025-54957 is an integer wraparound (CWE-190) in evo_priv.c's EMDF payload-size calculation, producing an undersized skip-buffer allocation and a controlled out-of-bounds write (CWE-787). Because Android Messages auto-decodes incoming RCS/MMS audio attachments via the Dolby decoder with no user interaction, a malicious audio message delivers code execution inside the SELinux-sandboxed mediacodec process. To port the Pixel 9 exploit to Pixel 10, the researchers updated memory offsets and, because Pixel 10 enforces RET PAC (pointer authentication on return addresses) where Pixel 9 relied on stack-protector, retargeted the corruption primitive to overwrite the dap_cpdp_init function pointer instead of __stack_chk_fail — defeating the additional mitigation in roughly a day of adaptation work.

Stage two is the newly disclosed privilege escalation: the VPU (video processing unit) driver's IOCTL handler vpu_mmap (bug 463438263 / Android tracker A-463674877, later assigned CVE-2026-0106) calls remap_pfn_range using only the caller-supplied VMA size rather than validating it against the true MMIO register-region size. By requesting an mmap() larger than the VPU's register window, a caller inside the mediacodec sandbox can map arbitrary adjacent physical memory — including the kernel image, which the Pixel bootloader decompresses at the fixed physical address 0x80010000 on every boot — directly into userland. Because Android's arm64 linear map is deliberately left unrandomized (to support up to 256GB of hypothetical memory hot-plug) and its virtual address is a static function of PHYS_OFFSET (phys_to_virt(x) = ((x) - 0x80000000) | 0xffffff8000000000), the attacker can compute the kernel's virtual base without leaking the KASLR slide, a technique Project Zero detailed separately in "Defeating KASLR by Doing Nothing at All" (2025-11-03). The researchers stated the resulting exploit required about 5 lines of code and under a day to develop, and Android's VRP rated it High severity — an escalation from the Moderate rating given the earlier, architecturally similar BigWave driver bug. Unlike a conventional Android camera/media driver, the VPU driver exposes the Wave677DV register interface directly to userspace at /dev/vpu without routing through the V4L2 media framework's normal bounds-checked buffer/memory-mapping layer, which is what let the missing check in vpu_mmap go undetected. Third-party vulnerability trackers (SentinelOne, AppSecure) independently catalog CVE-2026-0106 as a critical, no-user-interaction local elevation-of-privilege issue with a CVSS 3.1 base score of 9.3, corroborating Project Zero's High/root-equivalent severity assessment.

The VPU driver bug shares development lineage with the /dev/bigwave AV1 hardware-decode driver exploited in the Pixel 9 chain (CVE-2025-36934): both drivers wrap the Chips&Media Wave-series video-accelerator IP present on Tensor SoCs and are intentionally exposed to the restricted mediacodec SELinux context so hardware media decoding can be sandboxed. CVE-2025-36934 was a use-after-free race: the BIGO_IOCX_PROCESS ioctl waits up to 16 seconds for bigo_worker_thread to finish a job, but if enough jobs are queued ahead of the target, userland times out and closes /dev/bigwave's file descriptor while the worker thread is still running -- freeing the inst structure (which inline-embeds the job object) while bigo_worker_thread still holds a reference. The attacker reclaims that freed memory by spraying attacker-controlled kmalloc allocations (e.g., via Unix Domain Socket messages) to control the recovered job->regs pointer; when execution reaches bigo_pull_regs(), its memcpy_fromio(regs, core->base, core->regs_size) call writes the BigWave processor's register state through the corrupted pointer, giving a roughly 2144-byte arbitrary kernel write with no KASLR leak required.

That "no leak required" property comes from a separate primitive Project Zero detailed in "Defeating KASLR by Doing Nothing at All" (2025-11-03): because the ARM64 linear map's virtual base (0xffffff8000000000) and the Pixel bootloader's kernel decompression physical address (0x80010000) are both static, an attacker can read a target symbol's kernel-base offset from /proc/kallsyms and compute its absolute virtual address directly, without ever leaking the KASLR slide. In the Pixel 9 chain this is used to locate the modprobe_path kernel variable so the arbitrary-write primitive can overwrite it with an attacker-controlled path, causing the kernel's request_module() fallback to execute an attacker-supplied binary as root -- turning the BigWave arbitrary write into full root code execution.

CVE-2025-54957 (Dolby DD+/UDC) was fixed for Pixel and broader Android in the January 2026 Android Security Bulletin (SPL 2026-01-05), alongside CVE-2025-36934 (BigWave). CVE-2026-0106 (VPU driver) was fixed in the February 2026 Pixel Update Bulletin (SPL 2026-02-05), 71 days after the 2025-11-24 VRP report. This is a disclosed-and-patched research finding — Project Zero found no evidence of in-the-wild exploitation of either link in the chain — but it is tracked here for its zero-click chaining methodology (sandbox-exposed hardware-accelerator drivers + unrandomized ARM64 linear mapping) against Tensor-based Android devices, which is directly reusable against any future driver with the same missing-bounds-check pattern.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1658 Exploitation for Client Execution
- T1203 Exploitation for Client Execution
- T1575 Native API
- T1575 Native API
- T1404 Exploitation for Privilege Escalation
- T1626 Abuse Elevation Control Mechanism
- T1426 System Information Discovery
- T1082 System Information Discovery

## Sources

- [A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens](https://projectzero.google/2026/05/pixel-10-exploit.html)
- [A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby](https://projectzero.google/2026/01/pixel-0-click-part-1.html)
- [A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave](https://projectzero.google/2026/01/pixel-0-click-part-2.html)
- [Defeating KASLR by Doing Nothing at All](https://projectzero.google/2025/11/defeating-kaslr-by-doing-nothing-at-all.html)
- [Project Zero bug 463438263 (VPU driver vpu_mmap missing bounds check)](https://project-zero.issues.chromium.org/issues/463438263)
- [Pixel Update Bulletin—February 2026](https://source.android.com/docs/security/bulletin/pixel/2026/2026-02-01)
- [Android Security Bulletin—January 2026](https://source.android.com/docs/security/bulletin/2026/2026-01-01)
- [NVD - CVE-2025-54957](https://nvd.nist.gov/vuln/detail/CVE-2025-54957)
- [NVD - CVE-2026-0106](https://nvd.nist.gov/vuln/detail/CVE-2026-0106)
- [Dolby Security Advisory - CVE-2025-54957 (Oct 14, 2025)](https://professional.dolby.com/siteassets/pdfs/dolby-security-advisory-CVE-2025-54957-Oct-14-25.pdf)
- [Vulnerability in Dolby Decoder Can Allow Zero-Click Attacks](https://www.securityweek.com/vulnerability-in-dolby-decoder-can-allow-zero-click-attacks/)
- [Zero-click Dolby audio bug lets attackers run code on Android and Windows devices](https://www.malwarebytes.com/blog/news/2025/10/zero-click-dolby-audio-bug-lets-attackers-run-code-on-android-and-windows-devices)
- [Dolby Unified Decoder (CVE-2025-54957) POC](https://github.com/AlphabugX/CVE-2025-54957)
- [CVE-2026-0106: VPU IOCTL Privilege Escalation Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-0106/)
- [CVE-2026-0106 | Critical Vulnerability in Google Android](https://www.appsecure.security/vulnerability-database/cve-2026-0106/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2418