Modern mobile operating systems increasingly rely on automated background features to improve user experience, such as automated message transcription and media indexing. However, this expansion of automated parsing significantly increases the zero-click attack surface of modern smartphones. According to Project Zero, incoming RCS and SMS audio attachments processed by messaging applications are automatically decoded without requiring any direct interaction from the user. Researchers investigated these attack vectors and published a detailed analysis of a zero-click exploit chain targeting the Google Pixel 9.
Exploiting CVE-2025-54957 in the Dolby Unified Decoder
The attack chain begins by leveraging CVE-2025-54957, a critical vulnerability identified within the Dolby Unified Decoder component (UDC). The UDC is a proprietary software library responsible for processing Dolby Digital and Dolby Digital Plus audio streams, commonly integrated into hardware platforms as a compiled shared library. On the Google Pixel 9, this functionality is packaged within the vendor partition as a software codec library.
The underlying software defect stems from improper handling of variable-length size fields within the Extensible Metadata Delivery Format (EMDF) container embedded inside audio syncframes. During bitstream parsing, the decoder reads payload size fields using a custom variable-length integer decoding routine. Security analysts discovered that the specification and its software implementation lack proper upper-bound validation for the parsed payload length. Consequently, an attacker can supply an arbitrarily large value for the payload size parameter.
When the proprietary heap allocation function processes this oversized input, it requests memory allocation based on the untrusted size calculation. The subsequent byte-copy operation copies input data from the bitstream into the undersized heap buffer until the declared length is exhausted, resulting in a classic heap-based buffer overflow condition. By carefully crafting malicious audio bitstreams delivered via standard messaging vectors, researchers achieved arbitrary code execution within the restricted sandbox context of the media codec daemon.
Technical Impact and Privilege Escalation
Achieving code execution inside the media decoding sandbox represents only the initial stage of a comprehensive device compromise. To bypass operating system protections entirely, attackers must escalate privileges from the constrained service context to the operating system kernel. This secondary phase relied upon CVE-2025-36934, a separate vulnerability affecting a hardware driver accessible from the media codec sandbox environment on the target device. Chaining these vulnerabilities together allowed researchers to transition from a zero-click media message into full kernel-level execution.
Mitigation and Defensive Guidance
Security professionals and device administrators must prioritise prompt patch management to neutralise these attack vectors. Google addressed these component flaws in the security bulletins released for January 2026. Organizations managing fleet devices should take the following remediation steps:
- Apply the January 5, 2026 Android security patch level across all supported Google Pixel devices immediately.
- Audit mobile device management (MDM) configurations to ensure automated deployment of monthly firmware updates without user delay.
- Monitor security advisories from original equipment manufacturers for corresponding updates addressing third-party binary blobs and audio codec libraries.
Related: Project Zero Uncovers Android 0-Click Exploit Chain Ecosystem Weaknesses, Pixel 10 0-Click Exploit Chain: Re-Targeting CVE-2025-54957 for Root