TLDR Tech / InfoSec
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
Project Zero's Seth Jenkins ported the prior Pixel 9 Dolby UDC 0-click (CVE-2025-54957) to Pixel 10 by remapping offsets and replacing the RET PAC-blocked __stack_chk_fail overwrite with dap_cpdp_init, then replaced the absent BigWave LPE with a trivial flaw in the new Tensor G5 VPU driver (/dev/vpu, Chips&Media Wave677DV) where vpu_mmap calls remap_pfn_range using the caller-supplied VMA size without bounding to the MMIO register region. The Pixel kernel sits at a known fixed physical offset above the VPU register region, so an oversized mmap exposes kernel .text and .data for arbitrary read/write in five lines of code, yielding kernel code execution from the mediacodec SELinux context. Reported November 24, 2025, rated High severity, and patched 71 days later in the February Pixel bulletin.
Read the full story