A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens

This report describes research adapting a Dolby zero-click exploit to Pixel 10 and the discovery of a critical VPU driver mmap vulnerability on Pixel devices that allows userspace to map arbitrary physical memory starting at the VPU register region; because the kernel resides at a fixed offset from that region, attackers can achieve arbitrary kernel read/write and overwrite kernel functions to gain root. The authors detail exploit development, CVE-2025-54957 updates, the absence of the BigWave driver on Pixel 10 (and replacement by the VPU driver), the simple and fast exploitation path, and the vulnerability’s reporting and patching timeline (reported Nov 24, 2025 and patched in the February Pixel security bulletin, 71 days later).