What causes 0-click exploits on Pixel 9?

Audio transcription in Google Messages auto-decodes files with obscure codecs like Dolby UDC, letting attackers chain bugs remotely—no user action needed.

How long to exploit Pixel 9 vulnerabilities like CVE-2025-54957?

Project Zero clocked person-weeks: eight for the codec, three for the driver POC. Pros do it faster.

Will Google remove Dolby UDC from Pixels?

Unclear—recommendations push stripping it from 0-click paths, but OEM integrations and features complicate it. Patch and audit first.

🛡️ Security Tools

Pixel 9's Silent Killer: 0-Click Exploits via Obscure Audio Codecs

A Pixel 9 sits untouched, yet attackers slip in through audio messages. Google's overlooked codecs turn innocent buzzes into full compromises.

Threat Digest Apr 03, 2026 3 min read 12 views

Pixel 9 phone displaying incoming audio message with red vulnerability warning overlay

⚡ Key Takeaways

Dolby UDC and similar codecs bloat Pixel 9's 0-click surface via auto-audio processing. 𝕏
Bugs found in days; full chains in weeks—attackers thrive on overlooked spots. 𝕏
Drivers remain soft targets; AI features risk exploding vulnerabilities without audits. 𝕏

Published by

Threat Digest

Threat intelligence. Zero noise.

#0-click attack #0-click vulnerability #Android drivers #Android security #Dolby UDC #Pixel 9 exploit #Project Zero

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Google Project Zero

⚡ Key Takeaways

The 60-Second TL;DR

Threat Digest

Share this article

Worth sharing?

Related Stories

Pixel 9's Dolby Decoder: The 0-Click Path Project Zero Just Paved Wide Open

NoVoice Malware's Rampage: 2.3 Million Android Phones Rooted via Google Play

Pixel 9 Cracked Open: BigWave Driver's Triple Bug Sandbox Escape

Google's Android 16 Drops a Digital Fortress for Journalists and Politicians Under Siege

Stay in the loop