0-Click Exploit Found in Pixel 9's Dolby Decoder

What Happened

A new 0-click exploit has been discovered in the Dolby Unified Decoder^? of the Google Pixel 9. This vulnerability allows attackers to execute malicious code without any user interaction, making it particularly dangerous. The exploit takes advantage of how audio files are automatically decoded by the phone, which has become a growing attack surface due to recent AI features in mobile devices.

Researchers from Project Zero identified two critical vulnerabilities: CVE-2025-54957 in the Dolby decoder and CVE-2025-36934 related to a driver on the Pixel 9. These vulnerabilities expose most Android devices to potential attacks, as they involve the automatic processing of audio attachments^? in messages. The findings raise concerns about the security of modern Android systems and the effectiveness of their defenses against such exploits.

Why Should You Care

You might think your phone is safe, but this 0-click vulnerability means you could be attacked without even knowing it. Imagine receiving a seemingly harmless audio message, only to have your device compromised instantly. This could lead to unauthorized access to your personal data, like messages, photos, or even banking information.

For everyday users, this is a wake-up call to be cautious about the media you receive. Stay vigilant and consider the implications of automatic features on your device. Just like locking your doors at night, being aware of your phone's security is crucial for protecting your digital life.

What's Being Done

The security community is responding swiftly to these vulnerabilities. Google has already released patches to fix the identified issues as of January 5, 2026. Here’s what you should do:

• Update your Pixel 9 to the latest software version to ensure you have the patches.
• Be cautious with audio files from unknown sources.
• Monitor security updates from Google and other trusted sources.

Experts are closely watching for any signs of exploitation in the wild and are focused on improving defenses against similar vulnerabilities in the future. Understanding how these exploits function will help in creating more robust security measures for mobile devices.