A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
The Android ecosystem faces significant challenges in mitigating zero-click exploit chains, particularly concerning audio processing components and device drivers, according to recent research. While specific vulnerabilities in the Dolby UDC (Universal Decode Component) and a BigWave driver were identified and exploited, the broader implications highlight systemic issues in attack surface management, bug discovery, exploitability, and patch deployment across Android devices.
A key area of concern is the audio attack surface, exemplified by the Dolby UDC's integration into Google Messages on Pixel devices. Incoming audio messages are transcribed before user interaction, and on Pixel 9, a secondary process, com.google.android.tts, also decodes audio, seemingly for searchability. Both processes utilize device-wide decoders, including the UDC. While most incoming messages use common audio formats, the UDC is often employed for less frequent formats, typically found in commercial media. Researchers suggest that removing less commonly used decoders like the UDC from the zero-click attack surface could significantly enhance user security. The increasing prevalence of AI-powered features on mobile devices is also noted as a potential driver for expanding the zero-click attack surface, necessitating ongoing security reviews by mobile vendors to understand and manage the impact of new functionalities.
The speed at which vulnerabilities were discovered during this research was surprising. A Dolby UDC vulnerability was found in under two days during a one-week team hackathon, and a BigWave driver vulnerability was identified in less than a day. While significant preparation and tooling development preceded these discoveries, the time investment was considered small relative to the potential impact of a zero-click exploit. Researchers estimate that a well-resourced attacker could find the necessary vulnerabilities for such an exploit chain in a matter of person-weeks. Despite Android's investments in media codec security through bug bounty programs and fuzzing, gaps remain, as fuzzing efforts may not cover all components like the UDC. A comprehensive analysis of the zero-click attack surface and rigorous fuzzing and review processes are recommended for Android and its original equipment manufacturers (OEMs).
Device drivers, however, continue to be a persistent weak point in Android security. Despite efforts by Android and its upstream vendors to improve driver security, attackers have demonstrated a significant ability to find and exploit these vulnerabilities. Google's Threat Intelligence Group has documented numerous Android driver vulnerabilities exploited in the wild. Addressing this issue may require a multi-pronged approach, including rewriting vulnerable drivers in memory-safe languages like Rust, conducting consistent security reviews, limiting driver access from unprivileged contexts, and improving the updatability of driver code.
The ease with which these vulnerabilities could be exploited is also a concern. Exploiting the Dolby UDC vulnerability was estimated to take eight person-weeks, and the BigWave driver vulnerability took three person-weeks for a basic proof-of-concept. This is considered a relatively short timeframe given the capabilities of such exploit chains. The research also identified two specific security mitigations that did not function as expected. The Dolby UDC decoder process on Pixel 9 lacked a seccomp policy, which is present in the Android Open Source Project (AOSP) and other tested devices. The absence of this policy likely added significant development time to the exploit. Regular verification of security features across all releases is crucial to prevent such regressions.
Furthermore, kernel address space layout randomization (kASLR) was found to be ineffective on Pixel devices due to a long-standing issue. This decision to deprioritize kASLR's effectiveness made exploiting the BigWave vulnerability easier, potentially saving attackers weeks of effort. The research also noted that the Dolby UDC vulnerability was not exploitable on macOS or iPhones, partly due to the use of the `-fbounds-safety` compiler flag, which adds memory bounds checking. Dolby is encouraged to extend such compiler-based protections across all platforms. While Apple has implemented hardware-based memory protection technologies like MIE, which could probabilistically hinder exploits similar to the BigWave driver bug, its effectiveness is limited by the absence of compiler-level protections in some cases. Pixel devices have Memory Tagging Extension (MTE) support, but it is only enabled for users in Advanced Protection mode, limiting its benefit to the broader user base.
The exploit chain's efficiency, requiring only two software defects to gain kernel privileges from a zero-click context, is also noteworthy. This suggests that more robust sandboxing and privilege limitation features on Android, particularly for media decoding processes, could increase the complexity for attackers and necessitate longer exploit chains.
Finally, the timeframe for patching these vulnerabilities raises significant concerns. The UDC vulnerability was reported to Dolby in June 2025, with initial fixes appearing in ChromeOS in September 2025. Pixel devices did not receive these fixes until October 2025, and a public patch was not available until January 2026. This 139-day delay for a zero-click exploitable vulnerability to be patched on any Android device, and an additional 54 days for Pixel, is described as alarming. The vulnerability remained public for 82 days before Pixel shipped a patch.
