Zero‑Click Exploit Chain (CVE‑2025‑54957) Grants Root on Unpatched Google Pixel 10 Devices

Zero‑Click Exploit Chain (CVE‑2025‑54957) Grants Root on Unpatched Google Pixel 10 Devices

What It Is — Project Zero disclosed a two‑stage, zero‑click exploit chain that escalates from a crafted media file to full kernel root on Google Pixel 10 smartphones running Android 14 builds prior to the January 2026 security update (SPL December 2025 or earlier). The chain re‑uses the “Dolby” vulnerability (CVE‑2025‑54957) and adds a newly discovered flaw in the proprietary VPU driver (/dev/vpu) that maps hardware registers into userspace without proper isolation. By abusing the driver’s vpu_mmap routine, an attacker can write arbitrary values to kernel memory, bypassing existing mitigations such as RET PAC, and achieve persistent root. The exploit works without any user interaction (zero‑click) and has been released publicly for research purposes.

Affected Products — Google Pixel 10 (Android 14, SPL December 2025 or earlier).

Why It Matters for Trust & Control Assurance — The flaw highlights the importance of a robust vulnerability‑management control that ensures timely patching of operating‑system components, a control that maps to many frameworks (e.g., NIST CSF 2.0 Identify‑Protect).

Recommended Actions

• Verify the Android build version on all Pixel devices; confirm the January 2026 patch is applied.
• If unpatched, push the update immediately via your MDM or OTA channel.
• Add the VPU driver version to your asset inventory and monitor for future CVEs.
• Incorporate the exploit’s behavior (unexpected mmap of device registers) into mobile threat‑defense signatures.

Source: Google Project Zero – Pixel 10 exploit