Android CVE Tracker 2025-2026
Zero-Click Exploit Chains & Critical Vulnerabilities
A live tracker of real Android CVEs from 2025 and 2026 — covering the Pixel 9 zero-click exploit chain discovered by Google Project Zero, Samsung audio codec zero-click RCE, and critical privilege escalation vulnerabilities. All data sourced from Google Project Zero, Android Security Bulletins, NVD, and Samsung Mobile Security.
Android Settings > About phone > Software information — check your security patch level. The January 2026 patch fixes the Pixel 9 zero-click chain.
The Pixel 9 zero-click exploit chain — 2 vulnerabilities from an RCS audio message to full kernel compromise, discovered by Google Project Zero in under 3 days.
The Pixel 9 Zero-Click Exploit Chain
In January 2026, Google Project Zero published a complete zero-click exploit chain targeting the Pixel 9, demonstrating how an attacker could compromise the device by sending a crafted audio message — with no user interaction required. The chain exploits two vulnerabilities: one in the Dolby Unified Decoder (audio codec) and one in the BigWave kernel driver (hardware AV1 decoder). The research highlights how modern Android features like automatic audio transcription in Google Messages have expanded the 0-click attack surface.
The Research
Attributed to Russian-linked threat actors targeting Ukrainian users via watering hole attacks on compromised legitimate websites. iVerify estimated up to 270 million Androids remained on vulnerable iOS versions at the time of disclosure.
Relevance to Android: CVE-2024-49415 and CVE-2025-36934 directly affect Android. CVE-2025-48534 affects Chrome and Electron apps on Android. Mac users who visited compromised websites were potential targets.
The 2-CVE Exploit Chain
- 1. CVE-2025-54957 — Dolby Unified Decoder OOB write (Stage 1: RCE in mediacodec sandbox)
- 2. CVE-2025-36934 — BigWave driver privilege escalation (Stage 2: sandbox escape to kernel)
Attack flow: Send crafted audio message via RCS → Google Messages auto-transcribes audio → Dolby UDC processes audio → OOB write in mediacodec context → BigWave driver exploit → kernel read/write → full device compromise.
Why This Matters for Android Users
The Pixel 9 exploit chain demonstrates that Android's sandboxing and SELinux controls can be bypassed with a zero-click attack delivered through a standard RCS message. The Dolby UDC is in the 0-click attack surface of MOST Android devices, not just Pixel. Project Zero found these bugs in days — well-resourced attackers can too.
Key takeaways:
- Update to January 2026 security patch level or later
- The Dolby UDC is in the 0-click attack surface of MOST Android devices, not just Pixel
- Disable RCS audio transcription in Google Messages if you don't use it
- Android's patch fragmentation means devices stay vulnerable for months after fixes ship
- Project Zero found these bugs in days — well-resourced attackers can too
Disclaimer: This tracker is compiled from public sources including CISA KEV, Android Security Bulletins, NVD, Google Threat Intelligence Group, iVerify, Lookout, and security vendor blogs. Patch status changes rapidly — always verify against the Android Security Bulletins page and CISA KEV catalog for the latest status. Last updated: September 1, 2026.
Actively Exploited Zero-Days (Now Patched)
These Android vulnerabilities were exploited as zero-days in the wild before patches were available. All five are listed in CISA's Known Exploited Vulnerabilities catalog. If you haven't applied the relevant Apple security updates, you are still vulnerable. Check your Android version against the patch dates below.
Dolby Unified Decoder Out-of-Bounds Write (Zero-Click RCE)
An out-of-bounds write vulnerability in the Dolby Unified Decoder Component (UDC), which provides support for Dolby Digital (DD/AC-3) and Dolby Digital Plus (DD+/EAC-3) audio formats. The UDC is integrated into most Android devices as a binary blob. On the Pixel 9, it's in /vendor/lib64/libcodec2_soft_ddpdec.so. The vulnerability is in the 0-click attack surface because Google Messages automatically decodes incoming audio attachments for transcription before the user interacts with the message. A crafted audio file can trigger a heap buffer overflow leading to arbitrary code execution in the mediacodec context. Discovered by Google Project Zero (Ivan Fratric + team).
Update to January 2026 security patch level. Disable RCS audio transcription if not needed.
BigWave AV1 Decoder Driver Kernel Privilege Escalation
A privilege escalation vulnerability in the BigWave kernel driver (/dev/bigwave), hardware on the Pixel SoC that accelerates AV1 decoding. Accessible from the mediacodec SELinux context. Google Project Zero found three separate bugs in this driver, including one powerful enough to escape the mediacodec sandbox and achieve kernel arbitrary read/write on the Pixel 9. One bug was a duplicate of a February 2024 report that remained unfixed for over a year. Discovered by Seth Jenkins (Google Project Zero).
Update to Android 26.3 or later.
Samsung Monkey's Audio (APE) Decoder Out-of-Bounds Write
An out-of-bounds write in the Monkey's Audio (APE) decoder library (libsaped.so) on Samsung devices. The function saped_rec writes to a dmabuf allocated by the C2 media service (fixed size 0x120000), but can write up to 3 × blocksperframe bytes when processing 24-bit audio samples, causing a substantial buffer overflow. Fully remote (zero-click) on Samsung Galaxy S23/S24 if Google Messages is configured for RCS (the default), as the transcription service decodes incoming audio before user interaction. Discovered by Natalie Silvanovich (Google Project Zero).
Update to Android 26.2 or later. Safari 26.2 or later.
Android CellBroadcastHandler Privilege Escalation
An out-of-bounds write in ANGLE's Metal backend when uploading depth textures via a staging buffer. The staging buffer size uses GL_UNPACK_IMAGE_HEIGHT instead of actual texture height, causing GPU memory corruption. Served as the WebContent sandbox escape in the DarkSword exploit chain. Cross-browser: affects Chrome, Edge, and Electron apps on Android (not Android Safari, which uses native Metal WebGL). Discovered by Apple SEAR + Google GTIG.
Update Chrome to 143.0.7499.110+. Update Electron-based apps.
Dolby Unified Decoder Out-of-Bounds Write (Zero-Click RCE)
An out-of-bounds write vulnerability in the Dolby Unified Decoder Component (UDC), which provides support for Dolby Digital (DD/AC-3) and Dolby Digital Plus (DD+/EAC-3) audio formats. The UDC is integrated into most Android devices as a binary blob. On the Pixel 9, it's in /vendor/lib64/libcodec2_soft_ddpdec.so. The vulnerability is in the 0-click attack surface because Google Messages automatically decodes incoming audio attachments for transcription before the user interacts with the message. A crafted audio file can trigger a heap buffer overflow leading to arbitrary code execution in the mediacodec context. Discovered by Google Project Zero (Ivan Fratric + team).
Update Samsung device to December 2024 SMR or later. Disable RCS in Google Messages if not needed.
The Android Patch Fragmentation Problem
Unlike iOS, where Apple pushes updates to all supported devices simultaneously, Android's update ecosystem is fragmented across Google, Samsung, and dozens of other OEMs. This means critical vulnerabilities can remain unpatched on millions of devices for months after a fix is available.
The Update Ecosystem
- Google Pixel: Receives updates directly from Google (fastest patch cadence)
- Samsung flagship: Monthly Security Maintenance Releases (SMR)
- Other OEMs: Xiaomi, Oppo, Motorola — varying schedules, some quarterly, some never
- August 2026 Samsung SMR: Patched 7 Critical and 24 High CVEs from Google alone, plus 18 Samsung-specific SVEs
- BigWave driver bug: Remained unfixed for over a year despite being reported in February 2024
- Median patch time: 60-90 days from CVE disclosure to deployment on non-Pixel devices
Why This Matters for Android Users
Android's patch fragmentation is the platform's biggest security weakness. Even when Google patches a critical vulnerability, it can take months for the fix to reach Samsung, Xiaomi, and other devices — and some devices never get the update at all.
Key takeaways:
- Buy Pixel or Samsung flagship devices for fastest security updates
- Check your security patch level in Settings > About phone > Software information
- Google Play Protect is enabled by default but cannot prevent 0-click exploits
- Disable 2G networks to prevent stingray interception (see Android Defense Hub)
- Install updates within 7 days of release — don't wait
Disclaimer: This tracker is compiled from public sources including Google Project Zero, Android Security Bulletins, NVD, Samsung Mobile Security, and security vendor blogs. Patch status changes rapidly — always verify against the Android Security Bulletins and Samsung Mobile Security for the latest status. Last updated: September 1, 2026.
Is Your Android Device Really Secure?
With 5 actively exploited zero-days and a full-chain exploit kit targeting Android users, Apple security in 2026 requires active defense — not just "Macs don't get viruses." I can audit your Mac systems, apply security hardening, verify Screen Sharing is not exposed, and help you enable Lockdown Mode if you're at elevated risk.