Zero-Click Exploit Chain Discovered for Google Pixel 10

Google's Project Zero disclosed a zero-click exploit chain for the Pixel 10, building on previous research for the Pixel 9. This exploit allows attackers to escalate privileges to root without user interaction by chaining two vulnerabilities, including a critical Dolby decoding bug. The vulnerability was labeled the 'Holy Grail of kernel vulnerabilities' due to its simplicity and potential impact. Fortunately, Google patched this vulnerability in the February 2026 security bulletin, 71 days after it was reported. The exploit can only affect unpatched devices running the December 2025 security patch or earlier. Researchers emphasized the need for improved security practices in Android driver development to prevent such vulnerabilities.

Key Points: • Project Zero discovered a zero-click exploit chain for the Pixel 10, allowing root access. • The vulnerability was patched in February 2026, 71 days after initial reporting. • The exploit leverages a Dolby decoding bug and a vulnerable video processing driver.