NASA’s new dark energy space telescope can also detect killer asteroids
technologyreview.com·3h ago
Security
Google Project Zero·5 min read
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
TL;DR
Google Project Zero discovered that a Dolby audio processing vulnerability (CVE-2025-54957) enabled attackers to gain root access on Android devices without user interaction. Researchers successfully adapted their Pixel 9 exploit chain to work on Pixel 10, demonstrating the vulnerability persisted across Android versions until patched in January 2026.
✦ Why It Matters
Engineers must patch vulnerabilities across all affected device generations simultaneously to prevent attackers from exploiting older attack vectors on newer hardware.
Key Takeaways
- Update existing exploits for new device versions carefully.
- Audit drivers for security vulnerabilities regularly.
- Implement proactive security measures in software development.
- Respond quickly to reported vulnerabilities to enhance user safety.
How It Works
The vulnerability in the VPU driver allows users to map a larger memory area than intended, enabling access to the kernel's memory space. By exploiting this flaw, attackers can overwrite kernel functions, leading to full control over the device.