A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby

This Project Zero writeup analyzes a high-severity integer-overflow and parsing bug in the Dolby Unified Decoder (CVE-2025-54957) that expands the 0-click attack surface on Android by automatically decoding audio attachments; the author demonstrates a multi-stage exploit on Pixel 9 that attains arbitrary code execution in the mediacodec process (and describes escalation to kernel via CVE-2025-36934), documents exploitation primitives and reliability tradeoffs, and recommends mitigations including compiler bounds checks, stronger platform mitigations (seccomp, tightening /proc/self/mem access), and allocator hardening. The vulnerabilities were patched by January 5, 2026.