A 0-click exploit chain for the Pixel 10

Security researchers discovered a zero-click exploit chain for the Google Pixel 10 that allows attackers to achieve root access through two exploits: an updated Dolby vulnerability and a newly identified flaw in the VPU (video processing unit) driver. The VPU driver vulnerability is particularly severe, as it allows userspace applications to map and modify arbitrary kernel memory by specifying an oversized memory mapping, enabling direct kernel code execution. The exploit works on unpatched devices running security patches from December 2025 or earlier.