TL;DR
Security researchers have demonstrated a zero-click exploit chain for the Pixel 10, exploiting vulnerabilities in Dolby and VPU drivers. The exploits can lead to root access on unpatched devices, emphasizing the need for timely patches.
Researchers have revealed a zero-click exploit chain for the Pixel 10, capable of achieving root access on unpatched devices by exploiting vulnerabilities in Dolby libraries and the device’s VPU driver. This development underscores ongoing security risks on recent Android devices.
The exploit chain was adapted from previous work on the Pixel 9, with modifications to target the Pixel 10’s specific libraries and hardware. The Dolby vulnerability (CVE-2025-54957), patched in February 2026, was initially exploited to achieve privilege escalation. Additionally, researchers identified a critical flaw in the Pixel 10’s VPU driver, which interacts with Chips&Media’s WAVE677DV silicon used for video decoding.
The VPU driver exposes hardware registers directly to user space without proper bounds checking, allowing an attacker to map arbitrary physical memory, including kernel memory, into user space. This flaw enables attackers to overwrite kernel functions, leading to full kernel code execution and root access. The vulnerability was reported on November 24, 2025, rated high severity, and patched within 71 days in the February security bulletin.
Why It Matters
This discovery highlights significant security risks in the Pixel 10’s hardware and driver architecture, especially on devices that remain unpatched. The vulnerabilities could be exploited remotely or locally to compromise device integrity, data security, and user privacy. The rapid patching process also indicates an improving Android security posture, but the existence of such flaws underscores the importance of proactive vulnerability management.
TOOLSSIDE 2 Pack Security Patches Hook and Loop System – Security Patches for Uniforms with Embroidered Letters – One Small and One Large Security Patch – Security Patch for Vest or Jacket 10.75" x 4"
✅ Set of 2 security vest patch allows you to clearly identify your uniform on both sides of…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Background
The Pixel 10, released in late 2025, uses advanced hardware including the Chips&Media WAVE677DV silicon for video decoding. Previous research demonstrated a similar exploit chain on the Pixel 9, which was patched in January 2026. The current vulnerabilities in the Dolby library and VPU driver extend the attack surface, especially on devices that have not yet received security updates.
“The VPU driver’s MMIO mapping flaw allows mapping arbitrary physical memory, making kernel code execution straightforward.”
— Researcher involved in the discovery
“We prioritize rapid patching of high-severity vulnerabilities, as demonstrated by the swift fix of the VPU driver issue.”
— Android security team spokesperson
LELink Bluetooth Low Energy BLE OBD-II OBD2 Car Diagnostic Tool for iPhone/iPod/iPad and Android. New: Configurable Auto On/Off
New: User configurable auto on/off ZERO power standby mode and Passcode Protection.
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Remains Unclear
It remains unclear whether other hardware components or drivers in the Pixel 10 may harbor similar vulnerabilities. The full scope of potential exploits using these vulnerabilities has not been publicly disclosed, and exploit code is still under development.
VPU driver vulnerability fix for Pixel 10
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What’s Next
Manufacturers and users should ensure devices are updated with the latest security patches. Researchers will continue to analyze the Pixel 10 hardware for additional vulnerabilities, and Google is expected to enhance driver security and code audits to prevent future flaws.
Security Patch, 2 Pcs Reflective Security Hook and Loop Patch for Vest Printed Letters Embroidery Patches for Officer Guard Custom Uniforms Vest, Jacket, Carrier, Bag, Hat (Black, 1 Small and 1 Large)
【Package Content】The package contains two security patches for vest, one small (5.5 x 2.5 inches) and one large…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Can these exploits be used remotely?
The Dolby exploit requires the device to be unpatched, which may include remote attack vectors if the device is exposed to malicious content. The VPU driver flaw can be exploited locally or remotely if the device is unpatched and vulnerable.
Are all Pixel 10 devices affected?
The exploits target unpatched devices. Devices that have received the February 2026 security update are protected against these specific vulnerabilities.
What should users do to protect their devices?
Users should ensure their Pixel 10 devices are updated to the latest security patches released by Google, especially the February 2026 update.
Will Google release a patch for future hardware vulnerabilities?
Google emphasizes rapid patching for high-severity vulnerabilities, and ongoing efforts include improving driver security and code audits to reduce future risks.
