# Pixel 9 0-Click Sandbox Escape: BigWave UAF to Kernel R/W

> A critical 0-click exploit chain targets Google Pixel 9 devices, leveraging a Use-After-Free in the BigWave driver for kernel arbitrary read/write.

- Published: 2026-08-08T01:02:16.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Use After Free, Sandbox Escape, Zero Click, Pixel 9, BigWave Driver
- Author: Runtime Rebel Intel
- Primary source: https://projectzero.google/2026/01/pixel-0-click-part-2.html
- Canonical: https://runtimerebel.com/blog/pixel-9-0-click-sandbox-escape-bigwave-uaf-to-kernel-r-w

## Key points

- Google Pixel 9 devices are vulnerable to kernel arbitrary read/write via a 0-click exploit chain.
- Affected systems include Google Pixel 9 smartphones with unpatched BigWave driver vulnerabilities.
- Apply the security updates released on January 5, 2026, to mitigate this critical threat immediately.

## Overview: Critical [Sandbox](/glossary#sandbox) Escape on Pixel 9

Security researchers at [Google Project Zero](https://projectzero.google/2026/01/pixel-0-click-part-2.html) have detailed a critical sandbox escape [vulnerability](/glossary#vulnerability) affecting Google Pixel 9 devices. This flaw, discovered in the `/dev/bigwave` device driver, is a key component of a potential 0-click [exploit](/glossary#exploit) chain. By leveraging a [Use-After-Free](/glossary#use-after-free) (UAF) condition within the `BigWave` driver, an attacker can achieve kernel arbitrary read/write capabilities, effectively bypassing the `mediacodec` SELinux sandbox. This escalation from a constrained userland context to kernel-level control represents a severe compromise, allowing an attacker to execute arbitrary code with the highest privileges.

### Pixel 9 BigWave driver UAF exploitation details

The [exploit chain](/glossary#exploit-chain) begins from an initial userland compromise, specifically within the `mediacodec` SELinux context, which is typically constrained for non-secure software decoders. Using a custom `DriverCartographer` tool, researchers identified the `/dev/bigwave` device driver as accessible from this `mediacodec` context. The `BigWave` driver is integral to the Pixel System-on-Chip ([SOC](/glossary#soc)), providing hardware acceleration for AV1 decoding tasks.

During an audit of the `BigWave` driver code, three distinct bugs were uncovered. Notably, one was a duplicate of a bug reported in February 2024 that remained unfixed as of June 2025. The most critical of these, described as the "nicest bug," is a Use-After-Free (UAF) vulnerability. This flaw allows attackers to achieve kernel arbitrary read/write on the Pixel 9.

### The Use-After-Free Mechanism

The UAF vulnerability arises from a [race condition](/glossary#race-condition) during the handling of the `BIGO_IOCX_PROCESS` `ioctl` call. When a process opens `/dev/bigwave`, the driver allocates a kernel `inst` structure, which contains a `job` sub-structure to track hardware tasks. The `BIGO_IOCX_PROCESS` `ioctl` submits a job to a separate kernel thread, `bigo_worker_thread`, to be executed on the `BigWave` hardware. The `ioctl` then enters a `wait_for_completion_timeout` state for up to 16 seconds, awaiting job completion. If the `bigo_worker_thread` is sufficiently delayed, the `ioctl` call may time out and dequeue the job, returning control to userland, while the worker thread is still processing or about to process the same job.

If the userland process closes the file descriptor associated with the `BigWave` instance at this point, the `inst` structure and its nested `job` are freed. However, the `bigo_worker_thread` may continue to hold a reference to the now-freed `job` object. Subsequent accesses by the worker thread to this freed memory constitute a Use-After-Free condition. By spraying attacker-controlled `kmalloc` allocations, for example through Unix Domain Socket messages, the attacker can reoccupy the freed memory region. This allows them to control the `job->regs` pointer, thereby directing a 2144-byte arbitrary write to a location of their choosing within kernel memory. Furthermore, by carefully crafting the initial register values, attackers can ensure the final written content is also under their control.

This exploitation technique also effectively bypasses Kernel Address Space Layout Randomization (KASLR) without needing an information leak. The attacker controls the write destination by influencing the reallocated memory, illustrating how attackers achieve kernel arbitrary read/write on Pixel 9 through this UAF.

## Actionable Recommendations and Mitigations

Organizations and individual users of Google Pixel 9 devices must prioritize patching to address these critical vulnerabilities. Google released fixes for all three identified bugs on January 5, 2026. Prompt application of these updates is the primary and most effective mitigation.

*   **Immediate Patching:** Ensure all Google Pixel 9 devices are updated to the latest available software versions, specifically those released on or after January 5, 2026. This is the most crucial step to prevent exploitation.
*   **Monitor for Anomalies:** While direct indicators of compromise related to this specific UAF might be subtle, security teams should monitor for unusual activity originating from the `mediacodec` SELinux context or unexpected interactions with `/dev/bigwave` on Android devices.
*   **Regular Security Updates:** Maintain a policy of applying security updates promptly for all mobile devices, recognizing the critical role they play in mitigating sophisticated attack chains like this Pixel 9 mediacodec sandbox escape mitigation.
*   **[Endpoint](/glossary#endpoint) Detection and Response ([EDR](/glossary#edr)):** Deploying and configuring EDR solutions on Android enterprise devices can help detect post-exploitation activities, even if the initial exploit is zero-click.

**Related:** [Zimbra Zero-Click Exploitation by Russian APT for Email Theft](/blog/zimbra-zero-click-exploitation-by-russian-apt-for-email-theft), [AI Agent Sandbox Escape: Applying Traditional Security to Novel Threats](/blog/ai-agent-sandbox-escape-applying-traditional-security-to-novel-threats)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/pixel-9-0-click-sandbox-escape-bigwave-uaf-to-kernel-r-w