A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave

A Google Project Zero researcher discovered a 0-click exploit chain targeting the Pixel 9, leveraging a BigWave hardware accelerator and a vulnerability in the mediacodec SELinux context. The exploit bypasses security measures like KASLR and CFI, allowing for arbitrary read/write access to kernel memory. The vulnerability stems from a duplicate bug reported in February 2024 that remained unfixed until June 2025, combined with a clever technique to forge linked list structures and manipulate VFS handlers to achieve a reliable, arbitrary read/write primitive. The researcher demonstrated bypassing KASLR and CFI to gain full control over kernel memory, with the potential for crashes when toggling Wi-Fi. The exploit was developed to demonstrate a more reliable alternative to a previous 2144-byte arbitrary write.