Pixel 10 Hardening Changes the Exploit, Not the Root Path
Pixel 10’s RET PAC does not stop a zero-click Android compromise. It blocks the old stack-cookie overwrite target, but the exploit simply shifts to another writable initialization callback, so the attack still reaches root instead of dying at the first control-flow guard.
Google Project Zero ported its Pixel 9 chain to Pixel 10 by adapting CVE-2025-54957 in the Dolby library and changing the post-exploit primitive to fit the new build hardening. The updated chain works on unpatched devices, and the research shows the Dolby bug still gives attackers a zero-click foothold across Android.
The forward risk is that platform hardening can force exploit authors to rewrite their chain without removing the underlying exposure. For teams managing Pixel fleets or other Android devices that pick up the same media stack changes, the important question is no longer whether stack-protector-style defenses exist, but whether the remaining writable callbacks still let an attacker move from media parsing to full handset compromise.