This vulnerability involves a zero-click exploit chain on Android devices, initially demonstrated on the Pixel 9 and adapted for Pixel 10. The Pixel 10's VPU driver exposes the hardware MMIO register interface directly to userspace and uses an mmap handler that does not properly bound the size of the mapped region. This allows an attacker to map arbitrary physical memory starting at the VPU register region, including kernel memory regions such as .text and .data. Consequently, attackers can overwrite kernel functions to execute arbitrary code with kernel privileges. The Dolby 0-click vulnerability was patched in January 2026, but devices with SPL December 2025 or earlier remain vulnerable. The exploit chain was updated to handle Pixel 10's use of RET PAC instead of stack protector. The vulnerability affects Android kernel versions from 4.5 through 4.13.

Successful exploitation allows an attacker to gain root privileges on affected Android devices by mapping and modifying arbitrary kernel memory. This leads to full kernel code execution, compromising confidentiality, integrity, and availability of the device. The vulnerability is rated critical with a CVSS score of 9.8, reflecting its potential for complete system compromise without user interaction.

A patch was released in January 2026 that addresses the Dolby 0-click vulnerability and the associated exploit chain. Devices with SPL December 2025 or earlier are vulnerable and should be updated to the latest firmware containing the fix. Since this is not a cloud service, users must apply official vendor updates to remediate the issue. Patch status is not explicitly confirmed in the provided data, so users should verify with the vendor advisory for current remediation guidance.