Pixel 9's Dolby Decoder: The 0-Click Path Project Zero Just Paved Wide Open
A single SMS audio file. Zero taps. Full code execution on Pixel 9. Project Zero didn't just find bugs—they chained them into a nightmare for Android's vaunted security.
⚡ Key Takeaways
- Project Zero chained Dolby decoder RCE to kernel priv-esc on Pixel 9 via SMS audio—no user interaction.
- Dolby's skip buffer in DD+ allows spec-compliant overflows, hitting most Androids with UDC blobs.
- AI features like auto-transcription massively expand 0-click surface; media vulns demand priority fixes.
🧠 What's your take on this?
Cast your vote and see what Threat Digest readers think
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by Google Project Zero
Related Stories
Ransomware & Malware
0ktapus Phishing Snags 10,000 Credentials Across 130 Companies—Your MFA Is the Weak Link
Ransomware & Malware
Claude Code's 50-Command Cap: The Bypass That Unlocks Your Dev Machine
Ransomware & Malware
REF1695's ISO Trick: $9K Crypto Haul from Fake Installers and RATs
Ransomware & Malware