The Pixel 9 Zero-Click Exploit Chain That Breaks the Kernel

According to Google Project Zero, researchers have delineated a three-part zero-click exploit chain targeting the Google Pixel 9 that progresses from remote code execution during media decoding to kernel-level compromise. The chain hinges on vulnerabilities in audio processing and hardware drivers, with CVE-2025-54957 in the Dolby Unified Decoder facilitating memory corruption at the metadata processing stage, and CVE-2025-36934 in the /dev/bigwave driver enabling a bypass to obtain kernel primitives.

The researchers note that remediation for these vulnerabilities was incorporated into security updates on 5 January 2026, though the UDC flaw was first disclosed to Dolby on 26 June 2025 and made public on 15 October 2025, with Samsung reportedly patching by 12 November 2025 and Pixel users receiving the update only on 5 January 2026.

The analysis emphasises how increasingly intelligent features that pre-analyse message contents expand the zero-click attack surface, particularly through autonomous decoding of audio attachments by Google Messages. Finally, the piece highlights that the overall security of the device hinges on the speed with which the ecosystem delivers patches to end users.