Third-party cyber evaluations involving OpenAI models
openai.com·13h ago
Security
Google Project Zero·5 min read
A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
TL;DR
A significant vulnerability exists in the Android ecosystem, particularly related to the Dolby UDC audio codec, which can be exploited without user interaction. Researchers from Project Zero discovered two critical vulnerabilities, CVE-2025-54957 and CVE-2025-36934, during a focused hackathon.
✦ Why It Matters
Engineers should prioritize security reviews of new features to prevent increasing the attack surface for vulnerabilities.
Key Takeaways
- Conduct regular security reviews of audio processing components.
- Implement effective mitigations like seccomp policies in your applications.
- Prioritize rapid patching for critical vulnerabilities.
- Consider sandboxing strategies to limit privilege escalation opportunities.
How It Works
The exploit chain utilized vulnerabilities in the Dolby UDC audio decoder and the BigWave driver, allowing attackers to execute code without user interaction. The Dolby UDC processes incoming audio messages, which were exploited due to insufficient security measures, enabling privilege escalation with minimal effort.