A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave

A Project Zero deep dive into a design flaw around task_t in the XNU kernel, demonstrating sandbox escapes and privilege escalation and how each mitigation was defeated.

Fuzzing Android devices uncovered CVE-2016-3861 in libutils, a severe bug reachable from many attack vectors and usable for remote code execution and elevation into the system_server SELinux domain.

First part of Project Zero's Pixel 9 zero-click chain series, examining the Dolby audio decoder attack surface reachable from remote media input and developing a potential RCE exploit.

The concluding part of Project Zero's Pixel 9 zero-click exploit chain series, reflecting on lessons from the research and which platform improvements would raise the cost of such attacks.

This blog post discusses a bug leading to memory corruption in Samsung's Android kernel (specifically the kernel of the Galaxy A50, A505FN - I haven't looked at Samsung's kernels for other devices). I will describe the bug and how I wrote a (very unreliable) exploit for it. I will also describe how a second vulnerability, which had long been fixed in the upstream kernel, the upstream stable releases, and the Android common kernel, but not in Samsung's kernel, aided in its exploitation.

A Project Zero post on attacking NVIDIA's Windows kernel graphics driver, covering several of the 16 vulnerabilities found during this GPU attack surface research.