Zero-Click Exploits

The concluding part of Project Zero's Pixel 9 zero-click exploit chain series, reflecting on lessons from the research and which platform improvements would raise the cost of such attacks.

Why patches fail: of 8,100 fixes studied, 15.5% needed follow-up repairs; case studies like SharePoint ToolShell show bypasses within weeks — and what defenders should re-check.

Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.

Audit of WhatsApp's Private Inference found 28 issues, 8 high-severity, that could bypass its privacy guarantees — proving TEEs are no silver bullet for combining encryption with AI features.

Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.

Compiler optimizations like dead store elimination can strip security-critical code such as key sanitization; Trail of Bits studies binary layout hardening to blunt code-reuse exploits.