Zero-Click Exploit Chain Discovered for Google Pixel 10

Blogger

Zero-Click Exploit Chain Discovered for Google Pixel 10

First seen 15 May 2026, 23:23 UTC • •70.5

Article Content

1 / 6

Browse articles

ThreatCluster •May 16, 2026 at 23:21 UTC

•Project Zero discovered a zero-click exploit chain for the Pixel 10, allowing root access.
•The vulnerability was patched in February 2026, 71 days after initial reporting.
•The exploit leverages a Dolby decoding bug and a vulnerable video processing driver.

Google's Project Zero disclosed a zero-click exploit chain for the Pixel 10, building on previous research for the Pixel 9. This exploit allows attackers to escalate privileges to root without user interaction by chaining two vulnerabilities, including a critical Dolby decoding bug. The vulnerability was labeled the 'Holy Grail of kernel vulnerabilities' due to its simplicity and potential impact. Fortunately, Google patched this vulnerability in the February 2026 security bulletin, 71 days after it was reported. The exploit can only affect unpatched devices running the December 2025 security patch or earlier. Researchers emphasized the need for improved security practices in Android driver development to prevent such vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 147d ago How this analysis works

Timeline

2025-10-20

CVE-2025-54957 published

A vulnerability affecting Dolby decoding was disclosed, impacting multiple Android devices.

2025-10-30

First public PoC for CVE-2025-54957

Proof of concept for the Dolby decoding vulnerability was made public, demonstrating exploitability.

2026-02-01

Pixel 10 vulnerability patched

Google released a patch for the zero-click exploit chain in the February 2026 security bulletin.

2026-05-13

Project Zero discloses exploit chain details

Researchers revealed the exploit chain for Pixel 10, highlighting its simplicity and impact.

2026-05-16

Media coverage of exploit chain

Multiple news outlets reported on the exploit chain and its implications for Android security.

More articles in this cluster (5)

Threat Graph

12 entities, 21 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Organization (1)

Google Project Zero

Vulnerability (2)

CVE-2025-54957
Dolby 0-click Vulnerability

Weakness (2)

CWE-125 - Out-of-bounds Read
CWE-787 - Out-of-bounds Write

Affected Platform (4)

Android
Linux
Microsoft Exchange
Windows 11

Tool (1)

Google Chrome

Relationships

Google Chrome exploits CVE-2025-54957
Google Chrome exploits Dolby 0-click Vulnerability
CVE-2025-54957 targets Android
CVE-2025-54957 targets Linux
CVE-2025-54957 targets Microsoft Exchange
CVE-2025-54957 targets Windows 11
Dolby 0-click Vulnerability targets Android
Dolby 0-click Vulnerability targets Linux
Dolby 0-click Vulnerability targets Microsoft Exchange
Dolby 0-click Vulnerability targets Windows 11
Zero-day Exploit targets Android
Zero-day Exploit targets Linux
Zero-day Exploit targets Microsoft Exchange
Zero-day Exploit targets Windows 11
T1068 - Exploitation for Privilege Escalation targets Android
T1068 - Exploitation for Privilege Escalation targets Linux
T1068 - Exploitation for Privilege Escalation targets Microsoft Exchange
T1068 - Exploitation for Privilege Escalation targets Windows 11
CVE-2025-54957 related to Google Project Zero
CVE-2025-54957 related to CWE-125 - Out-of-bounds Read
CVE-2025-54957 related to CWE-787 - Out-of-bounds Write

Following this threat?

Track Google Project Zero and CVE-2025-54957 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…