A 0-click exploit chain for the Pixel 10

Join the discussion

• Hacker News
• Where are the iPhone jailbreaks didn’t see anything since a long time.. what’s happening? Did I miss them or isn’t anything available? I mean props to Apple however they do it but is it a matter of time in regard to the current timeline or what is actually going on?
  by sharpshadow
• Do we have any evidence on how AI has affected NSO et als’ businesses? Does it render them obsolete? Or are they now superpowered?
  by JumpCrisscross
• Project Zero has to report bugs to Android through the front door, and deal with Android VRP severity classification? I always assumed they could just walk over to the Android office and advocate for their bugs, face to face.
  by jeffbee
• This is a great bug report! I am not a kernel expert by any means even though I have read some about it... 10+ years ago. And I was able to follow along and see what was going on.

  It does make me scared for what other dangers lurk since this was a really bad one and it was so little work to find.

  Also of note: so many security issues lately have been done using AI. This report makes me think two things:

  1. Expertise is still immensely valuable, the more niche, the more valuable.

  2. There are lots of niches still where AI doesn't dominate...

  by phuff
• Hmmm... I'd like someone to double check my thinking here. I posted this exact prompt for gpt 5.5 xhigh:

  ```

  does this look right to you? don't do any searches or check memory, just think through first principles

  static int vpu_mmap(struct file fp, struct vm_area_struct vm) { unsigned long pfn; struct vpu_core core = container_of(fp->f_inode->i_cdev, struct vpu_core, cdev); vm_flags_set(vm, VM_IO | VM_DONTEXPAND | VM_DONTDUMP); / This is a CSRs mapping, use pgprot_device */ vm->vm_page_prot = pgprot_device(vm->vm_page_prot); pfn = core->paddr >> PAGE_SHIFT; return remap_pfn_range(vm, vm->vm_start, pfn, vm->vm_end-vm->vm_start, vm->vm_page_prot) ? -EAGAIN : 0; }

  ```

  And it correctly identified the issue at hand, without web searches. I'd love to try something more comprehensive, e.g. shoving whole chunks of the codebase into the prompt instead of just the specific function, but it seems the latent ability to catch security exploits is there.

  So then.... I wonder how this got out in the first place. I know I'm using a toy example but would love to learn more!

  by shay_ker
• Semi-related: has the rate of published exploits picked up as if late, or is it simply the fact that there’s hype around ai as security tool (offense or defense) so it’s simply in the news more often?

  Feels like there’s something new every other day - linux, windows, mobile, various commonplace tools used by everybody, the list goes on

  by revolvingthrow
• "This is notably fast given that this is the first time that an Android driver bug I reported was patched within 90 days of the vendor first learning about the vulnerability."

  This makes me feel better about Google, but also makes me kind of frightened of the rest of Android. I wonder what Apple's response time is?

  by greesil
• I followed the link to the Pixel 9 bug/exploit and saw this:

  "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user"

  Haven't we learned our lesson on this? Don't read and act on my sms messages without me asking you to!

  by krupan