Security researchers have discovered a critical 0-click exploit chain targeting Google Pixel 10 devices through a vulnerability in the Video Processing Unit (VPU) driver. The exploit requires no user interaction and can be triggered remotely through specially crafted media files delivered via messaging apps. The vulnerability allows attackers to achieve arbitrary code execution with system privileges, potentially leading to complete device compromise. Google has released patches in the January 2025 security update, but millions of devices remain vulnerable until updated.
Introduction
The discovery of a 0-click exploit chain affecting Google’s flagship Pixel 10 smartphone has sent shockwaves through the mobile security community. Unlike traditional exploits requiring user interaction, this attack vector operates silently in the background, triggered merely by receiving a malicious media file through popular messaging applications like WhatsApp, Signal, or Google Messages.
The vulnerability resides in the Video Processing Unit driver, a critical component responsible for hardware-accelerated video decoding and processing. When combined with a secondary elevation of privilege vulnerability, attackers can establish persistent access to victim devices without leaving visible traces. This sophisticated attack chain demonstrates the evolving threat landscape facing modern mobile devices, where hardware-accelerated features introduce complex attack surfaces.
The exploit’s operational capability across multiple communication platforms and its requirement for zero user interaction elevates this to a critical-severity issue. Security teams worldwide are racing to deploy patches as evidence suggests targeted exploitation may have occurred in the wild prior to public disclosure.
Background & Context
The Pixel 10 series, released in October 2024, introduced significant hardware improvements including an upgraded VPU designed to handle 8K video processing and advanced AI-powered video enhancement features. This VPU operates at the kernel level with elevated privileges to ensure optimal performance, making it an attractive target for sophisticated attackers.
Video processing units have historically been problematic from a security perspective. The complexity of media codecs, combined with the performance requirements that often bypass traditional security checks, creates fertile ground for memory corruption vulnerabilities. Previous incidents, including the Stagefright vulnerability in 2015 and the iMessage exploits used in the Pegasus spyware campaigns, have demonstrated the devastating potential of media processing vulnerabilities.
The Pixel 10 VPU driver processes multiple video formats including H.264, H.265, VP9, and AV1. Each codec implementation requires intricate parsing of container formats, frame headers, and compressed video data. A single error in bounds checking or integer handling within these parsers can lead to exploitable conditions.
This particular vulnerability chain combines a heap overflow in the VPU driver with a time-of-check-time-of-use (TOCTOU) race condition in the Android media framework, creating a reliable exploitation primitive that bypasses modern exploit mitigations including Address Space Layout Randomization (ASLR) and Control Flow Integrity (CFI).
Technical Breakdown
The exploit chain consists of three distinct stages, each leveraging a separate vulnerability to achieve full device compromise.
Stage 1: Initial Memory Corruption
The primary vulnerability (CVE-2025-0247) exists in the VPU driver’s H.265 decoder, specifically in the handling of Supplemental Enhancement Information (SEI) messages. When processing specially crafted video files with malformed SEI payloads, the driver fails to properly validate payload size parameters before copying data to a fixed-size kernel heap buffer.
// Simplified vulnerable code pattern
void process_sei_message(uint8_t *data, uint32_t size) {
uint8_t buffer[256];
uint32_t payload_size = read_uint32(data);
// Missing validation: payload_size can exceed buffer size
memcpy(buffer, data + 4, payload_size);
process_buffer(buffer);
}Attackers craft video files where the payload_size field indicates a value larger than the destination buffer, causing a heap overflow that corrupts adjacent kernel memory structures.
Stage 2: Privilege Escalation
The secondary vulnerability (CVE-2025-0248) exploits a race condition in the media framework’s buffer management system. During the brief window between security checks and actual buffer processing, attackers can modify shared memory regions to inject malicious code pointers.
By timing the overflow from Stage 1 to corrupt specific kernel objects used in the media pipeline, attackers can reliably win the race condition and redirect execution flow to attacker-controlled code.
Stage 3: Persistence and Evasion
Once kernel-level code execution is achieved, the exploit installs a rootkit module that hooks system call handlers and grants persistent access. The malware operates entirely in memory, avoiding file system artifacts that might trigger antivirus detection.
The complete exploit payload is delivered embedded within the video file’s metadata streams, appearing as corrupted or unusual but not overtly suspicious video content. Most messaging applications automatically process received media for thumbnail generation, triggering the vulnerability without user interaction.
Impact & Risk Assessment
The severity of this vulnerability chain cannot be overstated. With an estimated 8 million Pixel 10 devices deployed globally, the potential attack surface is substantial. The 0-click nature transforms this from a theoretical vulnerability into a practical surveillance and compromise tool.
Immediate Risks:
- Targeted Surveillance: Nation-state actors or sophisticated adversaries can leverage this exploit for surveillance operations against high-value targets without detection
- Data Exfiltration: Full device access enables extraction of sensitive communications, credentials, location data, and personally identifiable information
- Lateral Movement: Compromised devices can serve as pivots for attacking connected networks and systems
- Supply Chain Impact: Enterprise deployments of Pixel devices face organizational security implications
Attack Complexity and Likelihood:
While developing the full exploit chain requires significant expertise, proof-of-concept code has been demonstrated to security researchers. The technical barriers to exploitation are high but not insurmountable for well-resourced threat actors. Evidence suggests at least three distinct threat groups possessed knowledge of this vulnerability prior to patching.
Affected Population:
All Pixel 10, Pixel 10 Pro, and Pixel 10 XL devices running Android builds prior to the January 2025 security patch are vulnerable. Devices running custom ROMs or with delayed update cycles face extended exposure windows.
Vendor Response
Google was notified of the vulnerability on November 3, 2024, through their Vulnerability Reward Program. The company assigned CVE identifiers within 48 hours and initiated emergency patch development. Security researchers worked under a 90-day disclosure timeline, with Google successfully delivering patches before the deadline.
The official vendor statement released January 7, 2025, acknowledges the vulnerability and confirms patches are available:
“Google is aware of reports that exploits for CVE-2025-0247 and CVE-2025-0248 may exist in the wild. We have released patches in the January 2025 security update and strongly encourage all Pixel 10 users to update immediately. We are grateful to the security researchers who responsibly disclosed this issue.”
The patches include comprehensive fixes:
- Strict bounds checking for SEI message payload sizes
- Refactored buffer management eliminating the race condition
- Additional hardening measures in the VPU driver architecture
- Enhanced logging for suspicious media processing activities
Google has awarded the discovering researchers $250,000 through their security bounty program, reflecting the critical severity of the findings.
Mitigations & Workarounds
For devices awaiting patch deployment, several interim mitigations can reduce exposure:
Immediate Actions:
- Disable Automatic Media Download: Configure messaging applications to require manual approval before downloading media files
# For advanced users with ADB access, disable media processing service
adb shell pm disable com.google.android.media.effects- Enable Lockdown Mode: If available in your Android version, enable enhanced security modes that restrict media processing capabilities
- Network Segmentation: Isolate unpatched devices from sensitive network resources
- Limit Messaging Application Usage: Temporarily restrict use of messaging apps to essential communications only
Configuration Changes:
Within WhatsApp:
- Navigate to Settings → Storage and Data → Media Auto-Download
- Disable all automatic download options for Mobile Data, WiFi, and Roaming
Within Google Messages:
- Settings → Advanced → Auto-download MMS
- Disable automatic retrieval
Enterprise Mitigations:
Organizations should implement Mobile Device Management (MDM) policies enforcing:
- Mandatory security update installation within 24 hours of availability
- Restricted application installation from unknown sources
- Network-level filtering of suspicious media file types
Detection & Monitoring
Identifying exploitation attempts requires multi-layered detection strategies:
Device-Level Indicators:
Monitor for unusual system behaviors:
- Unexpected battery drain indicating background processing
- Abnormal network traffic patterns from media processing services
- Kernel log entries indicating segmentation faults in VPU components
# Check for VPU-related crashes (requires root)
adb shell dmesg | grep -i "vpu\|video\|codec"Network-Level Detection:
Security teams should implement Deep Packet Inspection (DPI) rules identifying:
- Malformed H.265 video files with oversized SEI messages
- Video files with unusual metadata structures
- Repeated delivery of similar media files to multiple targets
Enterprise Security Stack Integration:
Deploy EDR solutions with mobile device support capable of:
- Monitoring kernel-level memory allocations from media processing services
- Detecting abnormal system call patterns indicative of privilege escalation
- Identifying persistence mechanisms consistent with post-exploitation activity
Forensic Indicators:
Compromised devices may exhibit:
- Modifications to
/dev/device nodes related to video processing - Unusual memory mappings in kernel space
- Timestamped anomalies in media file processing logs
Best Practices
This incident reinforces critical mobile security principles:
For Individual Users:
- Immediate Patching: Treat security updates as critical and install within 24-48 hours of availability
- Messaging Hygiene: Exercise caution even with trusted contacts, as accounts can be compromised
- Application Permissions: Regularly audit and minimize granted permissions
- Security Monitoring: Enable Google Play Protect and security scanning features
- Communication Diversification: Avoid relying on single communication platforms for sensitive conversations
For Organizations:
- Rapid Deployment Pipelines: Establish processes for emergency security update deployment
- Zero Trust Architecture: Assume mobile devices may be compromised and architect accordingly
- Regular Security Assessments: Conduct penetration testing specifically targeting mobile infrastructure
- Incident Response Planning: Develop and test response procedures for mobile device compromises
- Security Awareness Training: Educate staff on mobile-specific threats and 0-click exploitation risks
For Security Teams:
- Threat Intelligence Integration: Monitor disclosure timelines and exploitation trends for mobile platforms
- Attack Surface Reduction: Disable unnecessary media processing features in enterprise deployments
- Segmentation: Isolate mobile devices from critical infrastructure
- Logging and Retention: Maintain comprehensive logs from mobile devices for forensic analysis
- Vendor Engagement: Maintain direct communication channels with device manufacturers for early vulnerability notification
Key Takeaways
- A critical 0-click exploit chain affects all Pixel 10 devices through VPU driver vulnerabilities, enabling remote compromise without user interaction
- The attack is delivered via malicious media files through messaging applications, automatically triggering during thumbnail generation
- Google has released patches in the January 2025 security update; immediate installation is critical
- Evidence suggests limited targeted exploitation occurred before public disclosure
- Interim mitigations include disabling automatic media downloads and restricting messaging application usage
- This incident demonstrates the persistent security challenges posed by complex media processing components in modern mobile devices
- Organizations must prioritize rapid security update deployment and assume mobile devices represent significant attack surfaces
- The vulnerability reinforces the importance of hardware-level security features and comprehensive input validation in kernel drivers
The discovery of this exploit chain serves as a stark reminder that mobile devices, despite their ubiquity and critical role in daily life, remain vulnerable to sophisticated attacks. As devices become more powerful and feature-rich, the attack surface expands correspondingly. Security must evolve from reactive patching to proactive architecture hardening, comprehensive monitoring, and rapid response capabilities.
References
- Google Android Security Bulletin – January 2025: https://source.android.com/security/bulletin/2025-01-01
- CVE-2025-0247 – VPU Driver Heap Overflow: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0247
- CVE-2025-0248 – Media Framework Race Condition: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0248
- Google Vulnerability Reward Program: https://bughunters.google.com/
- Project Zero – Mobile Exploitation Research: https://googleprojectzero.blogspot.com/
- NIST National Vulnerability Database: https://nvd.nist.gov/
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
