Google Project Zero has published details of an exploit chain that achieves root on Android from a zero-click context. The research, demonstrated on a Google Pixel 9, used two exploits in sequence, showing how a single vulnerability can be leveraged into full system compromise without any user interaction.
The chain relied on a Dolby-related flaw that was present across the entire Android ecosystem, not just the Pixel. According to the source, this bug was patched in January 2026. Project Zero notes that while the specific door has closed, the general class of vulnerabilities remains a concern.
The write-up underscores the value of coordinated disclosure and the need for rapid patching, especially for bugs that can be triggered remotely. No other sources were provided, so the analysis is based solely on Project Zero's report.