Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby

projectzero.google | blog | #ai-security | #rce | #android | #exploit-chain | #zero-click | #pixel | #dolby | #decoder

Summary

First part of Project Zero's Pixel 9 zero-click chain series, examining the Dolby audio decoder attack surface reachable from remote media input and developing a potential RCE exploit.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
The concluding part of Project Zero's Pixel 9 zero-click exploit chain series, reflecting on lessons from the research and which platform improvements would raise the cost of such attacks.
blog · projectzero.google
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
A Google Project Zero post describing an attempt to build a zero-click exploit chain to root for the Pixel 10, following their earlier two-exploit Pixel 9 chain.
blog · projectzero.google
A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave
Second part of Project Zero's Pixel 9 zero-click chain research: auditing the BigWave AV1 decoder driver reachable from the mediacodec sandbox and finding bugs that yield kernel read and write.
advisory · projectzero.google
Return to libstagefright: exploiting libutils on Android
Fuzzing Android devices uncovered CVE-2016-3861 in libutils, a severe bug reachable from many attack vectors and usable for remote code execution and elevation into the system_server SELinux domain.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
back