Project Zero details Pixel 9 0-click chain and Android audio attack surface

What happened

Project Zero released the third installment of its Pixel 9 0-click exploit chain analysis. The post shifts from technical exploit details to ecosystem-level issues observed while finding, reporting, and using the vulnerabilities. It highlights how Android processes incoming audio before user interaction, creating a remote code execution path that does not require a click.

Who is affected

Pixel 9 devices are directly affected by the described chain. The broader concern applies to Android devices that transcribe or decode incoming audio in Google Messages or similar messaging features, especially when uncommon codecs such as Dolby UDC are available. The chain relied on CVE-2025-54957 in Dolby UDC and CVE-2025-36934 in the BigWave driver.

Why it matters

The audio path is significant because messages can be processed before a user opens them. On Pixel 9, Google Messages transcribes incoming audio, and a separate com.google.android.tts process also decodes audio, likely to support search. Both paths can exercise device codecs, including formats that are rarely used in normal messaging but are present in the system. That increases the amount of code reachable by an attacker sending a crafted media file.

What to do

• Apply vendor patches for CVE-2025-54957 and CVE-2025-36934, and verify that Pixel 9 devices are receiving the latest Android security updates.
• Review whether uncommon audio codecs, especially Dolby UDC and other rarely used decoders, need to be reachable from messaging, transcription, or TTS pipelines.
• Audit new AI, search, transcription, and media features for 0-click and 1-click exposure, particularly when they parse untrusted files before user interaction.
• Track exploit-chain indicators in mobile threat reports and prioritize devices that expose remote audio processing to enterprise risk models.

Defensive takeaway

Mobile convenience features can silently expand the remote attack surface. Defenders should treat pre-user audio processing as a high-value target and require explicit security review for codecs, parsers, and AI pipelines that handle incoming messages.