KEVWire

Security intelligence, with context.

Response snapshot Oct 26, 2026, 22:09 UTC

Back to the wire
Permalink
Advisoryproject-zero-pixel-10-exploit-1635f685d5eb

A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens

We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026.

Published Updated

At a glance

Sources
1 source

What to do

Read the exact official research article before applying its defensive techniques or drawing conclusions.

Read Google Project Zero Research: A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens (opens a new tab)

What happened

We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit chain for the Pixel 9, we wanted to see if it was possible to write a similar exploit chain for Pixel 10.

Updating the Dolby Exploit Altering our exploit for CVE-2025-54957 was fairly straightforward. The majority of needed changes involved updating offsets calculated for the specific version of the library we targeted on the Pixel 9 to similar offsets in the library for Pixel 10.

The only challenge (outside of wishing we’d better documented which syncframes contained offsets) was that the Pixel 10 uses RET PAC in the place of -fstack-protector, which meant that __stack_chk_fail wasn’t available to be overwritten by code.

After a bit of trial and error, we used dap_cpdp_init, initialization code that can be overwritten without causing functional problems, as it is called once when the decoder is initialized and never again.

Sources

  1. Primary source

    Google Project Zero Research: A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens (opens a new tab)

    Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt.

    Published Checked

  2. Primary source

    Google Project Zero Research syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, May 13). A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens. https://kevwire.com/record/project-zero-pixel-10-exploit-1635f685d5eb

MLA

"A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens." KEVWire, 13 May 2026, kevwire.com/record/project-zero-pixel-10-exploit-1635f685d5eb.

Chicago

KEVWire. "A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens." Last modified May 13, 2026. https://kevwire.com/record/project-zero-pixel-10-exploit-1635f685d5eb.

Evidence summary (plain text)

A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens (May 13, 2026).
We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit chain for the Pixel 9, we wanted to see if it was possible to write a similar exploit chain for Pixel 10. Updating the Dolby Exploit Altering our exploit for CVE-2025-54957 was fairly straightforward. The majority of needed changes involved updating offsets calculated for the specific version of the library we targeted on the Pixel 9 to similar offsets in the library for Pixel 10. The only challenge (outside of wishing we’d better documented which syncframes contained offsets) was that the Pixel 10 uses RET PAC in the place of -fstack-protector, which meant that __stack_chk_fail wasn’t available to be overwritten by code. After a bit of trial and error, we used dap_cpdp_init, initialization code that can be overwritten without causing functional problems, as it is called once when the decoder is initialized and never again.
Sources:
Google Project Zero Research: A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens: https://projectzero.google/2026/05/pixel-10-exploit.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
Record ID: project-zero-pixel-10-exploit-1635f685d5eb.
Record origin: Ingested record.
AI evidence: Not assessed.
About this data

This record was ingested from a data source. Retrieved: Oct 26, 2026, 21:35 UTC. Ingestion is not an independent editorial investigation.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail