HIGH Threat Intel #Android

Project Zero Uncovers Android 0-Click Exploit Chain Ecosystem Weaknesses

2026-08-08 01:01 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: Android users, especially Pixel 9 owners, face significant risk from sophisticated 0-click exploit chains targeting overlooked attack surfaces.
Affected systems: Pixel 9 devices, specifically their Dolby UDC and BigWave drivers, alongside other Android devices with vulnerable audio codecs and drivers.
Remediation: OEMs must conduct rigorous attack surface analysis, enhance fuzzing efforts, and enforce security features like seccomp policies consistently.

Project Zero’s latest report, the third part of a series detailing a 0-click exploit chain for the Pixel 9, shifts focus from technical recommendations to systemic issues within the broader Android ecosystem. The research highlights critical shortcomings in how audio processing, driver security, and mitigation enforcement are handled, offering an insightful Pixel 9 exploit chain analysis and actionable recommendations for improvement, according to Project Zero.

Analysis of Android 0-Click Attack Surface Issues

Expanding Audio Attack Surface

The Dolby UDC (Universal Decoding Core) stands out as a significant 0-click attack surface on most Android devices, primarily due to audio transcription in applications like Google Messages. Incoming audio messages are processed and transcribed before user interaction, engaging decoders like the UDC. On Pixel 9, an additional process, com.google.android.tts, also decodes incoming audio, likely for searchability, further expanding the attack surface. While these processes ideally handle a limited set of common audio formats, all available decoders, including the UDC, are engaged. The UDC supports formats mostly used by commercial media, making it unlikely for legitimate incoming messages to use them, yet its presence in the 0-click path creates unnecessary exposure. Project Zero identified a vulnerability, CVE-2025-54957, in the Dolby UDC, underscoring this risk. The proliferation of AI-powered features on mobile phones further exacerbates this, potentially increasing 0-click attack surfaces significantly.

Rapid Vulnerability Discovery in Android Driver Security

One striking revelation from Project Zero’s research was the speed at which critical vulnerabilities were discovered. Researchers found CVE-2025-54957 in the Dolby UDC in less than two days during a hackathon, and CVE-2025-36934 in the BigWave driver in under a day. While preparation for attack surface identification and tooling development took weeks, the actual bug-finding phase was remarkably short. This suggests that for a well-resourced attacker, the time required to find vulnerabilities for a 0-click exploit chain on Android could be measured in person-weeks. This highlights a critical challenge for mitigating Android driver vulnerabilities. Google’s Threat Intelligence Group (GTIG) has reported 16 Android driver vulnerabilities exploited in the wild since 2023, confirming that drivers remain a soft target for attackers, outpacing vendor efforts in security.

Exploitation Ease and Mitigation Gaps

Exploiting the Dolby UDC vulnerability took an estimated eight person-weeks, and the BigWave driver vulnerability three person-weeks for a basic proof-of-concept. These timelines are notably short given the power of such exploit chains. Project Zero observed two critical mitigation failures on Pixel 9 devices: the Dolby UDC decoder process lacked a seccomp policy (despite being implemented in AOSP and other Android 16 devices), and kernel Address Space Layout Randomization (kASLR) was ineffective due to a long-standing issue. The absence of an enforced seccomp policy alone would likely have added at least a person-month to the exploitation effort, emphasizing the importance of consistent verification of security features across releases.

Actionable Recommendations for Enhancing Android Security

To address the systemic issues exposed by this research, Project Zero proposes several key improvements:

Reduce 0-Click Attack Surface: OEMs should rigorously review and remove uncommonly-used decoders from the 0-click audio processing path to minimize exposure to vulnerabilities in these codecs. This aligns with a broader goal of Android 0-click attack surface reduction.
Comprehensive Attack Surface Analysis: Android and its OEMs need to undertake rigorous analysis of their entire 0-click attack surface, coupled with extensive fuzzing and security reviews, especially for components that may be overlooked.
Improve Driver Security: Address the persistent problem of driver vulnerabilities through multiple approaches:
- Rewriting the most vulnerable drivers in managed languages like Rust.
- Performing consistent security reviews on new drivers.
- Reducing driver access from unprivileged contexts.
- Making driver code more easily updatable on Android devices.
Verify Security Features Consistently: Regularly verify the enforcement of crucial security features like seccomp policies and the effectiveness of kASLR for every Android release to prevent regressions and ensure intended protections are active.

#Android

X/Twitter LinkedIn Reddit HN

← Back to Articles