--- title: Google Researchers Hacked the Pixel Phone using Audio... description: Two Google Project Zero researchers, Natalie Silvanovich and Seth Jenkins, describe how they built a zero-click exploit chain against Pixel 9 and Pixel 10... canonical: https://daily.dev/posts/google-researchers-hacked-the-pixel-phone-using-audio-messages-igtszuukq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google Researchers Hacked the Pixel Phone using Audio Messages | daily.dev og:description: Two Google Project Zero researchers, Natalie Silvanovich and Seth Jenkins, describe how they built a zero-click exploit chain against Pixel 9 and Pixel 10... og:url: https://daily.dev/posts/google-researchers-hacked-the-pixel-phone-using-audio-messages-igtszuukq og:image: https://api.daily.dev/og/posts/igTsZUuKQ.png og:image:alt: Google Researchers Hacked the Pixel Phone using Audio Messages og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google Researchers Hacked the Pixel Phone using Audio Messages **[David Bombal](https://daily.dev/sources/davidbombal)** · 39 min read · 1 upvotes · 0 comments ## Summary Two Google Project Zero researchers, Natalie Silvanovich and Seth Jenkins, describe how they built a zero-click exploit chain against Pixel 9 and Pixel 10 devices using malicious audio messages. The attack abused a bug in Dolby's UDC (EAC3) audio codec, triggered automatically by Android's audio transcription feature, then pivoted through a media codec sandbox escape into vulnerable VPU driver code (big_wave/big_ocean) to achieve kernel code execution. They detail bypassing ASLR and SELinux, the roughly 8-10 weeks of full-time work involved, use of AI (Gemini) for tedious tasks like writing encoders and syscall headers, and how Apple's iOS avoided the bug because it compiled the same Dolby codec with bounds-checking flags. All issues have been patched on up-to-date Pixel 9 and Pixel 10 devices, and the pair discuss attack surface reduction, fuzzing, and mitigations like MTE and compiler sanitizers as ways to harden future devices. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did Google researchers create a zero-click exploit on Pixel phones using audio messages? They exploited a memory corruption bug in Dolby's UDC (EAC3) audio codec, which Android's audio message transcription feature processes automatically without user interaction. After gaining code execution in the media codec sandbox, they exploited a use-after-free bug in the Pixel 9's big_wave VPU driver and an unbounded mmap bug in the Pixel 10's VPU driver to reach kernel code execution, bypassing ASLR and SELinux along the way. _Developers tracking mobile exploit chains and codec vulnerabilities follow writeups like this on daily.dev._ ### Are Pixel 9 and Pixel 10 phones still vulnerable to this Dolby audio codec zero-click exploit? No, the vulnerabilities have been patched and any Pixel 9 or Pixel 10 running an up-to-date software version is safe. The exploit chain required two CVEs per phone (one shared codec bug plus a device-specific VPU driver bug), all of which Google fixed after Project Zero's research and disclosure. _Security teams patching Android fleets rely on daily.dev to stay current on fixed mobile CVEs._ ### Why did Apple's iOS avoid the Dolby UDC codec bug that affected Android Pixel phones? Apple compiled the same Dolby UDC decoder itself with a compiler flag that added bounds checking, which eliminated the vulnerability on iOS even though the underlying codec code was identical to the one used on Android. Android lacked this compiler-level bounds checking, leaving the same buggy code exploitable on Pixel devices. _Engineers weighing compiler mitigations like bounds checking track these tradeoffs on daily.dev._ ## Similar posts on daily.dev - [A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?](https://daily.dev/posts/a-0-click-exploit-chain-for-the-pixel-9-part-3-where-do-we-go-from-here--qjrdywt1p) · Project Zero · 0 upvotes · 0 comments - [A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby](https://daily.dev/posts/a-0-click-exploit-chain-for-the-pixel-9-part-1-decoding-dolby-nrcxllz0p) · Project Zero · 0 upvotes · 0 comments - [A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens](https://daily.dev/posts/a-0-click-exploit-chain-for-the-pixel-10-when-a-door-closes-a-window-opens-crecn1dw3) · Project Zero · 0 upvotes · 0 comments - [A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave](https://daily.dev/posts/a-0-click-exploit-chain-for-the-pixel-9-part-2-cracking-the-sandbox-with-a-big-wave-sfp83oxnx) · Project Zero · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#android](https://daily.dev/tags/android) [View this post on daily.dev](https://daily.dev/posts/google-researchers-hacked-the-pixel-phone-using-audio-messages-igtszuukq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google Researchers Hacked the Pixel Phone using Audio Messages","url":"https://daily.dev/posts/google-researchers-hacked-the-pixel-phone-using-audio-messages-igtszuukq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-researchers-hacked-the-pixel-phone-using-audio-messages-igtszuukq"},"datePublished":"2026-09-03T14:13:37.303Z","dateModified":"2026-09-03T14:14:11.199Z","description":"Two Google Project Zero researchers, Natalie Silvanovich and Seth Jenkins, describe how they built a zero-click exploit chain against Pixel 9 and Pixel 10...","image":"https://i.ytimg.com/vi/TrtCJaz0sdo/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/TrtCJaz0sdo/sddefault.jpg","isAccessibleForFree":true,"articleSection":"David Bombal","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"David Bombal","logo":"https://media.daily.dev/image/upload/s--Dz6oUxSb--/f_auto/v1710503980/logos/davidbombal","url":"https://daily.dev/sources/davidbombal"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-researchers-hacked-the-pixel-phone-using-audio-messages-igtszuukq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,android","timeRequired":"PT39M","video":{"@type":"VideoObject","name":"Google Researchers Hacked the Pixel Phone using Audio Messages","description":"Two Google Project Zero researchers, Natalie Silvanovich and Seth Jenkins, describe how they built a zero-click exploit chain against Pixel 9 and Pixel 10...","thumbnailUrl":"https://i.ytimg.com/vi/TrtCJaz0sdo/sddefault.jpg","uploadDate":"2026-09-03T14:13:37.303Z","duration":"PT39M","url":"https://api.daily.dev/r/igTsZUuKQ","embedUrl":"https://www.youtube.com/embed/TrtCJaz0sdo"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"David Bombal","item":"https://daily.dev/sources/davidbombal"},{"@type":"ListItem","position":3,"name":"Google Researchers Hacked the Pixel Phone using Audio Messages"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-researchers-hacked-the-pixel-phone-using-audio-messages-igtszuukq#faq","mainEntity":[{"@type":"Question","name":"How did Google researchers create a zero-click exploit on Pixel phones using audio messages?","acceptedAnswer":{"@type":"Answer","text":"They exploited a memory corruption bug in Dolby's UDC (EAC3) audio codec, which Android's audio message transcription feature processes automatically without user interaction. After gaining code execution in the media codec sandbox, they exploited a use-after-free bug in the Pixel 9's big_wave VPU driver and an unbounded mmap bug in the Pixel 10's VPU driver to reach kernel code execution, bypassing ASLR and SELinux along the way. Developers tracking mobile exploit chains and codec vulnerabilities follow writeups like this on daily.dev."}},{"@type":"Question","name":"Are Pixel 9 and Pixel 10 phones still vulnerable to this Dolby audio codec zero-click exploit?","acceptedAnswer":{"@type":"Answer","text":"No, the vulnerabilities have been patched and any Pixel 9 or Pixel 10 running an up-to-date software version is safe. The exploit chain required two CVEs per phone (one shared codec bug plus a device-specific VPU driver bug), all of which Google fixed after Project Zero's research and disclosure. Security teams patching Android fleets rely on daily.dev to stay current on fixed mobile CVEs."}},{"@type":"Question","name":"Why did Apple's iOS avoid the Dolby UDC codec bug that affected Android Pixel phones?","acceptedAnswer":{"@type":"Answer","text":"Apple compiled the same Dolby UDC decoder itself with a compiler flag that added bounds checking, which eliminated the vulnerability on iOS even though the underlying codec code was identical to the one used on Android. Android lacked this compiler-level bounds checking, leaving the same buggy code exploitable on Pixel devices. Engineers weighing compiler mitigations like bounds checking track these tradeoffs on daily.dev."}}]} ```