CVE-2025-54957Exploit

🚨 Google Project Zero just published a Pixel 10 zero-click to root exploit chain. Two vulnerabilities and less than a day of work to weaponize the second one. Chain: - Stage 1: same Dolby UDC zero-click (CVE-2025-54957) used against the Pixel 9. Patched in January 2026. Only minor offset updates and a tweak around RET PAC needed to port to Pixel 10 - Stage 2: a brand new local privilege escalation in the VPU driver for the Chips&Media Wave677DV on the Tensor G5 Result: arbitrary kernel read/write in 5 lines of code. Full exploit written in under a day.

Google Project Zero published a 0-click exploit chain for the Pixel 10 that can achieve root access on Android using just two vulnerabilities. Dolby zero-click exploit (CVE-2025-54957) to work on Pixel 10 with minor changes. The old BigWave driver (used for privilege escalation on Pixel 9) is gone, but they found a new, extremely simple bug in the VPU driver (/dev/vpu) for the Tensor G5 chip's video decoder. The VPU bug allows any app to map the entire kernel memory into user space via a flawed mmap function — essentially giving full read/write access to kernel code and data. https://projectzero.google/2026/05/pixel-10-exploit.html ref: vpu driver mmap allows OOB physical mappings [463438263] https://project-zero.issues.chromium.org/issues/463438263

CVE-2025-54957 was patched upstream in December through a Pixel update prior. The article also references that this is a porting of a Pixel 9 exploit chain of theirs mentioning a weakness in a weak exploit mitigation (KASLR) that's long resolved in GrapheneOS. Great work by P0.

Project Zero published a full 0-click exploit chain against the Pixel 10. Stage 1: CVE-2025-54957 in the Dolby UDC audio decoder library running in mediaserver. Processing untrusted media triggers memory corruption through syncframe offset manipulation. The updated technique overwrites the dap_cpdp_init function pointer to bypass PAC-RET. Patched in the January 2026 Android security bulletin. Stage 2: Bug in the VPU driver at /dev/vpu on Tensor G5's Chips&Media Wave677DV. The vpu_mmap() handler calls remap_pfn_range() without checking the size against the register region. An mmap syscall with a size larger than the region maps arbitrary physical memory. On Pixel, the kernel sits at a fixed physical address. Attackers use the known offset between the VPU MMIO region and the kernel - no scanning required. Arbitrary kernel read/write in five lines of code. From there, kernel code execution and root. Seth Jenkins and Jann Horn audited the VPU driver and spotted the flaw in under two hours. They built the full LPE exploit in less than one day. Reported November 24, 2025. Patched February 2026 - 71 days later. Affected Pixel 10 devices with SPL of December 2025 or earlier. Hardware vendors skipping framework safeguards turn media decoders into kernel gateways.

Top 5 Trending CVEs: 1 - CVE-2020-17103 2 - CVE-2026-8507 3 - CVE-2026-3854 4 - CVE-2026-46333 5 - CVE-2025-54957 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

Google 🇺🇸 Project Zero demonstrates new 0-click to root exploit chain on Pixel 10, combining updated Dolby vulnerability with critical VPU driver flaw that exposes entire kernel memory to userspace modification. Key technical details: • CVE-2025-54957: Updated Dolby UDC exploit bypasses RET PAC protections by targeting dap_cpdp_init initialization code instead of __stack_chk_fail • VPU driver flaw: vpu_mmap() function lacks bounds checking, allowing unlimited physical memory mapping via remap_pfn_range() • Kernel exploitation: Fixed physical address layout enables direct kernel .text/.data overwrite without memory scanning • Attack surface: /dev/vpu accessible from mediacodec SELinux context on Tensor G5 devices Exploitation chain: • Stage 1: 0-click Dolby vulnerability gains initial code execution • Stage 2: VPU driver maps kernel memory into userspace with 5 lines of code • Full privilege escalation achieved in under 24 hours development time DFIR artifacts: • Look for unusual mmap() syscalls with large size parameters targeting /dev/vpu • Monitor mediacodec process memory mappings for suspicious physical address ranges • Check for unexpected kernel memory modifications in crash dumps Hunt for processes accessing /dev/vpu with oversized memory mappings. Patched in February 2026 SPL - verify device patch levels. #DFIR_Radar

⚠️ ALERTA: Descubierta cadena de exploits de 0 clics para Google Pixel 10. Acceso a raíz del sistema Android en 2 exploits. CVE-2025-54957. https://projectzero.google/2026/05/pixel-10-exploit.html #CiberseguridadMX #CyberSecurity #Ransomware

Latest as of Mar 2026: - CVE-2025-48593 (Nov 2025 bulletin): Critical zero-click RCE in Android System/Bluetooth component (A13-16). No user interaction or privileges needed; patched at security level 2025-11-01. - Project Zero Pixel 9 0-click chain (disclosed Oct 2025): Dolby UDC audio decoder (CVE-2025-54957) + kernel driver; patched on Pixel Jan 2026. - Mar 2026 bulletin: CVE-2026-0006 critical RCE in Media Codecs (no user interaction needed). Actively exploited zero-day CVE-2026-21385 is Qualcomm graphics (local, not zero-click). Update ASAP to latest patch level.

@blackorbird CVE-2025-54957 (Dolby 0-click) + BigWave driver LPE = full kernel compromise. The kicker? The kernel exploit took 5 lines of code and less than a day to write. This is what "Holy Grail" looks like. http://vulntracker.io

BREAKING: Google Project Zero reveals zero-click exploit chain giving full kernel control on unpatched Pixel 10 via video processing driver bug building on CVE-2025-54957. https://threatcluster.io/cluster/zero-click-exploit-chain-discovered-for-google-pixel-10-e3b03a90