Google Project Zero Reveals Sophisticated Zero-Click Exploit Chain Targeting Pixel 9

Project Zero, has disclosed a sophisticated zero-click exploit chain targeting the Pixel 9 smartphone, demonstrating that highly advanced attacks remain viable even against modern Android security defenses.

The research, published in January 2026, showcases how threat actors could compromise devices through audio attachments in SMS and RCS messages without any user interaction.​

Critical Vulnerabilities in Audio Decoding Pipeline

The exploit chain leverages two critical vulnerabilities: CVE-2025-54957 in the Dolby Unified Decoder and CVE-2025-36934 in a driver accessible from the decoder’s sandbox on Pixel 9 devices.

CVE-2025-54957, an integer overflow vulnerability affecting the Dolby Digital Plus audio decoder, exists in the zero-click attack surface of most Android devices currently in use.

The vulnerability stems from a flaw in how the decoder processes Extensible Metadata Delivery Format (EMDF) payloads, where insufficient bounds checking allows attackers to trigger controlled buffer overruns.

The Dolby Unified Decoder, integrated across Android, iOS, Windows, and media streaming devices, processes audio in the Dolby Digital (AC-3) and Dolby Digital Plus (EAC-3) formats. On Pixel 9, the vulnerable component resides in /vendor/lib64/libcodec2_soft_ddpdec.so.

The decoder automatically processes incoming audio attachments through Google Messages before users open them, creating an expanded zero-click attack surface introduced by AI-powered transcription features.​

Project Zero researchers developed a proof-of-concept exploit requiring three specially crafted MP4 files delivered as message attachments. The attack manipulates the decoder’s memory allocation system, specifically targeting the “evo heap” structure and exploiting weaknesses in Android’s scudo allocator.

By carefully orchestrating memory overwrites and leveraging partial ASLR bypass techniques, the exploit achieves arbitrary code execution within the mediacodec context.​

The researchers employed sophisticated primitives, including WRITE DYNAMIC, WRITE STATIC, and WRITE DYNAMIC FAST, to manipulate memory regions, ultimately overwriting function pointers in the static buffer to gain control of the program counter.

The exploit then chains to CVE-2025-36934 to escalate privileges from the mediacodec sandbox to the kernel level, completing the whole device compromise.​

Due to Address Space Layout Randomization (ASLR) guessing requirements, the exploit succeeds approximately once every 256 attempts, requiring an average of six minutes to compromise a target device.

While this represents a practical attack window for sophisticated threat actors, the complexity underscores both the robustness of Android’s security architecture and the persistence of skilled adversaries.​

Google patched both vulnerabilities as of January 5, 2026. Project Zero’s research emphasizes that several Android mitigations proved effective, particularly ASLR implementation, though critical gaps emerged.

The Pixel 9 notably lacked seccomp policies present on competing devices like the Samsung S24, and /proc/self/mem accessibility provided attackers a shortcut to code execution.

On iOS and macOS, the Dolby decoder compiled with -fbounds-safety flags appears immune to this specific exploitation technique.​

The disclosure aims to inform defenders about real-world zero-click attack methodologies, highlighting the continued importance of promptly patching media decoder and driver vulnerabilities on mobile platforms.

Project Zero will release additional technical details in subsequent blog posts covering privilege escalation techniques and defensive recommendations.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.