A 0-click exploit chain for the Pixel 10

Researchers have revealed a zero-click exploit chain for the Pixel 10, capable of achieving root access on unpatched devices by exploiting vulnerabilities in Dolby libraries and the device’s VPU driver. This development underscores ongoing security risks on recent Android devices.

The exploit chain was adapted from previous work on the Pixel 9, with modifications to target the Pixel 10’s specific libraries and hardware. The Dolby vulnerability (CVE-2025-54957), patched in February 2026, was initially exploited to achieve privilege escalation. Additionally, researchers identified a critical flaw in the Pixel 10’s VPU driver, which interacts with Chips&Media’s WAVE677DV silicon used for video decoding.

The VPU driver exposes hardware registers directly to user space without proper bounds checking, allowing an attacker to map arbitrary physical memory, including kernel memory, into user space. This flaw enables attackers to overwrite kernel functions, leading to full kernel code execution and root access. The vulnerability was reported on November 24, 2025, rated high severity, and patched within 71 days in the February security bulletin.

Why It Matters

This discovery highlights significant security risks in the Pixel 10’s hardware and driver architecture, especially on devices that remain unpatched. The vulnerabilities could be exploited remotely or locally to compromise device integrity, data security, and user privacy. The rapid patching process also indicates an improving Android security posture, but the existence of such flaws underscores the importance of proactive vulnerability management.

Background

The Pixel 10, released in late 2025, uses advanced hardware including the Chips&Media WAVE677DV silicon for video decoding. Previous research demonstrated a similar exploit chain on the Pixel 9, which was patched in January 2026. The current vulnerabilities in the Dolby library and VPU driver extend the attack surface, especially on devices that have not yet received security updates.

“The VPU driver’s MMIO mapping flaw allows mapping arbitrary physical memory, making kernel code execution straightforward.”

— Researcher involved in the discovery

“We prioritize rapid patching of high-severity vulnerabilities, as demonstrated by the swift fix of the VPU driver issue.”

— Android security team spokesperson

What Remains Unclear

It remains unclear whether other hardware components or drivers in the Pixel 10 may harbor similar vulnerabilities. The full scope of potential exploits using these vulnerabilities has not been publicly disclosed, and exploit code is still under development.

What’s Next

Manufacturers and users should ensure devices are updated with the latest security patches. Researchers will continue to analyze the Pixel 10 hardware for additional vulnerabilities, and Google is expected to enhance driver security and code audits to prevent future flaws.

Key Questions

Can these exploits be used remotely?

The Dolby exploit requires the device to be unpatched, which may include remote attack vectors if the device is exposed to malicious content. The VPU driver flaw can be exploited locally or remotely if the device is unpatched and vulnerable.

Are all Pixel 10 devices affected?

The exploits target unpatched devices. Devices that have received the February 2026 security update are protected against these specific vulnerabilities.

What should users do to protect their devices?

Users should ensure their Pixel 10 devices are updated to the latest security patches released by Google, especially the February 2026 update.

Will Google release a patch for future hardware vulnerabilities?

Google emphasizes rapid patching for high-severity vulnerabilities, and ongoing efforts include improving driver security and code audits to reduce future risks.