Pixel 9 0-Click Sandbox Escape: BigWave UAF to Kernel R/W

Overview: Critical Sandbox Escape on Pixel 9

Security researchers at Google Project Zero have detailed a critical sandbox escape vulnerability affecting Google Pixel 9 devices. This flaw, discovered in the /dev/bigwave device driver, is a key component of a potential 0-click exploit chain. By leveraging a Use-After-Free (UAF) condition within the BigWave driver, an attacker can achieve kernel arbitrary read/write capabilities, effectively bypassing the mediacodec SELinux sandbox. This escalation from a constrained userland context to kernel-level control represents a severe compromise, allowing an attacker to execute arbitrary code with the highest privileges.

Pixel 9 BigWave driver UAF exploitation details

The exploit chain begins from an initial userland compromise, specifically within the mediacodec SELinux context, which is typically constrained for non-secure software decoders. Using a custom DriverCartographer tool, researchers identified the /dev/bigwave device driver as accessible from this mediacodec context. The BigWave driver is integral to the Pixel System-on-Chip (SOC), providing hardware acceleration for AV1 decoding tasks.

During an audit of the BigWave driver code, three distinct bugs were uncovered. Notably, one was a duplicate of a bug reported in February 2024 that remained unfixed as of June 2025. The most critical of these, described as the “nicest bug,” is a Use-After-Free (UAF) vulnerability. This flaw allows attackers to achieve kernel arbitrary read/write on the Pixel 9.

The Use-After-Free Mechanism

The UAF vulnerability arises from a race condition during the handling of the BIGO_IOCX_PROCESS ioctl call. When a process opens /dev/bigwave, the driver allocates a kernel inst structure, which contains a job sub-structure to track hardware tasks. The BIGO_IOCX_PROCESS ioctl submits a job to a separate kernel thread, bigo_worker_thread, to be executed on the BigWave hardware. The ioctl then enters a wait_for_completion_timeout state for up to 16 seconds, awaiting job completion. If the bigo_worker_thread is sufficiently delayed, the ioctl call may time out and dequeue the job, returning control to userland, while the worker thread is still processing or about to process the same job.

If the userland process closes the file descriptor associated with the BigWave instance at this point, the inst structure and its nested job are freed. However, the bigo_worker_thread may continue to hold a reference to the now-freed job object. Subsequent accesses by the worker thread to this freed memory constitute a Use-After-Free condition. By spraying attacker-controlled kmalloc allocations, for example through Unix Domain Socket messages, the attacker can reoccupy the freed memory region. This allows them to control the job->regs pointer, thereby directing a 2144-byte arbitrary write to a location of their choosing within kernel memory. Furthermore, by carefully crafting the initial register values, attackers can ensure the final written content is also under their control.

This exploitation technique also effectively bypasses Kernel Address Space Layout Randomization (KASLR) without needing an information leak. The attacker controls the write destination by influencing the reallocated memory, illustrating how attackers achieve kernel arbitrary read/write on Pixel 9 through this UAF.

Actionable Recommendations and Mitigations

Organizations and individual users of Google Pixel 9 devices must prioritize patching to address these critical vulnerabilities. Google released fixes for all three identified bugs on January 5, 2026. Prompt application of these updates is the primary and most effective mitigation.

• Immediate Patching: Ensure all Google Pixel 9 devices are updated to the latest available software versions, specifically those released on or after January 5, 2026. This is the most crucial step to prevent exploitation.
• Monitor for Anomalies: While direct indicators of compromise related to this specific UAF might be subtle, security teams should monitor for unusual activity originating from the mediacodec SELinux context or unexpected interactions with /dev/bigwave on Android devices.
• Regular Security Updates: Maintain a policy of applying security updates promptly for all mobile devices, recognizing the critical role they play in mitigating sophisticated attack chains like this Pixel 9 mediacodec sandbox escape mitigation.
• Endpoint Detection and Response (EDR): Deploying and configuring EDR solutions on Android enterprise devices can help detect post-exploitation activities, even if the initial exploit is zero-click.

Related: Zimbra Zero-Click Exploitation by Russian APT for Email Theft, AI Agent Sandbox Escape: Applying Traditional Security to Novel Threats