OffensiveCon26 - A 0-Click Exploit Chain For The Pixel 10

Zero-click goal

Google Project Zero researchers Natalie Silvanovich and Seth Jenkins describe a Pixel 10 chain beginning from an RCS or text message with no user interaction. Android's local audio transcription for message attachments makes codecs zero-click because attachments are decoded on-device before speech recognition.

Dolby UDC / EMDF bug

Ivan Fratric found a bug quickly in Dolby Digital Plus's Extensible Metadata Delivery Format—a nested bitstream processed via a skip buffer inside sync frames. read_variable_bits supplies attacker-controlled sizes to evil_malloc, where integer overflow can allocate zero bytes yet write attacker-controlled contents, including out-of-bounds reads past the skip buffer.

Heap and exploitation

The decoder uses a simple slab allocator without free; each sync frame gets a fresh heap wiped after playback. Overflow can corrupt the skip-buffer pointer for arbitrary or partial overwrites. Natalie explored targeting writable pointers in the library after the overflow primitive.

Chain overview

The full exploit chain combines this audio codec issue with privilege escalation via Pixel driver bugs (Bigwave and VPU depending on device). Seth was slated to cover the kernel/driver stages after the codec explanation.