Vulnerabilities
Pixel 9 BigWave Driver Exploits: 0‑Click Privilege Escalation via MediCodec Context
Researchers discovered three critical bugs in the Pixel 9’s BigWave AV1 acceleration driver that allow a mediCodec sandbox escape and kernel arbitrary read/write. The vulnerabilities were fixed on Jan 5 2026, but defenders should verify firmware updates and monitor /dev/bigwave activity.
What Happened
During a security review of the Pixel 9’s mediCodec SELinux context, a researcher found that the /dev/bigwave device is accessible from the sandbox. Three separate bugs in the driver grant an attacker kernel‑level arbitrary read/write, enabling a 0‑click privilege escalation.
Impact
All Pixel 9 devices running the affected kernel and BigWave driver are vulnerable. An attacker can escape the mediCodec sandbox, read and write arbitrary kernel memory, and execute code with root privileges. The flaw is exploitable from userland without additional user interaction.
Mitigation
Google released a patch for all three bugs on Jan 5 2026. Defenders should ensure devices are running the latest OTA update that includes the BigWave driver fix. Additionally, monitor for anomalous /dev/bigwave usage and consider disabling the AV1 hardware accelerator if not required.
What to Do Now
- Verify device firmware is up to date (Android 13 or later).
- Check the kernel version for the BigWave driver patch.
- Audit SELinux policies to confirm /dev/bigwave is no longer accessible from mediCodec context.
- Implement monitoring of ioctl calls to /dev/bigwave for suspicious activity.
Technical Notes
Each bug involved improper handling of the job structure in the driver’s open and ioctl paths. The most powerful bug allowed an attacker to overwrite the private_data pointer of an open file descriptor, leading to arbitrary kernel memory access.
Related vulnerabilities
Project Zero details Pixel 9 0-click chain and Android audio attack surface
Project Zero published the third part of its Pixel 9 0-click exploit chain research, focusing on how audio processing in Google Messages and Pixel 9 TTS expands remote attack surface. The chain used CVE-2025-54957 in Dolby UDC and CVE-2025-36934 in the BigWave driver, both found quickly after targeted review. Defenders should prioritize patching, reduce unnecessary codec exposure, and audit AI/media features that process untrusted input before user interaction.
Read briefing
Google Pixel 10 Exploits Earned $560,000 at Pwn2Own
At Pwn2Own Ireland 2026, three teams extracted more than $560,000 from Google Pixel 10 devices by chaining zero‑day and known flaws. The attacks demonstrate that even mainstream Android phones can be compromised via remote code execution. Defenders should prioritize patching, monitor for suspicious network activity, and enforce least‑privilege policies on mobile endpoints.
Read briefing
Google Patches Pixel Modem Privilege Escalation Flaw (CVE-2026-58704)
Google released a patch for a high‑severity privilege escalation flaw in the Pixel Cellular Modem (CVE‑2026‑58704). The vulnerability, which can be exploited without user interaction, has been observed in limited, targeted attacks. Defenders should update devices to the September 2026 build and monitor for anomalous modem activity.
Read briefing
CVE-2026-83694: Windows Volume Manager Extension Driver Local Privilege Escalation
Microsoft has disclosed a local privilege escalation vulnerability in the Windows Volume Manager Extension Driver (CVE‑2026‑83694). An authenticated attacker can trigger an out‑of‑bounds read, allowing elevation of privileges on the affected system. Defenders should apply the latest security updates and verify driver integrity.
Read briefing