CVE-2025-36934
published 2025-12-11CVE-2025-36934: In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local…
PriorityP340high7.4CVSS 3.1
AVLACHPRNUINSUCHIHAH
EPSS
0.10%
0.8th percentile
In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3r28-hhhx-hfjf: In bigo_worker_thread of private/google-modules/video/gchips/bigo
ghsa_unreviewed·2025-12-11
CVE-2025-36934 [MEDIUM] CWE-362 GHSA-3r28-hhhx-hfjf: In bigo_worker_thread of private/google-modules/video/gchips/bigo
In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2025-36934: In bigo_worker_thread of private/google-modules/video/gchips/bigo
osv·2025-12-01
CVE-2025-36934 CVE-2025-36934: In bigo_worker_thread of private/google-modules/video/gchips/bigo
In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
Projectzero
A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby
blogs_projectzero·2026-01-14·CVSS 7.4
[HIGH] A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby
Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user. One such feature is audio transcription. Incoming SMS and RCS audio attachments received by Google Messages are now automatically decoded with no user interaction. As a result, audio decoders are now in the 0-click attack surface of most Android phones.
Iâve spent a fair bit of time investigating these decoders, first reporting CVE-2025-49415 in the Monkeyâs Audio codec on Samsung devices. Based on this research, the team reviewed the Dolby Unified Decoder, and Ivan Fra
Projectzero
A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
blogs_projectzero·2026-01-14·CVSS 7.4
[HIGH] A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement.
## Audio Attack Surface
com.google.android.tts
Both processes decode audio using all decoders available on the device, including the UDC, which is integrated by the OEMs of most devices, though the bulk of incoming messages use a small number of audio formats. In particular, it is very unlikely that an incoming message will contain audio in formats supported by the Dolby UDC, as Android devices do not provide encoders for these
Projectzero
A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
blogs_projectzero
A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement.
## Audio Attack Surface
The Dolby UDC is part of the 0-click attack surface of most Android devices because of audio transcription in the Google Messages application. Incoming audio messages are transcribed before a user interacts with the message. On Pixel 9, a second process `com.google.android.tts` also decodes incoming audio. Its purpose is not completely clear, but it seems to be related to making incoming messages searchab
Projectzero
A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby
blogs_projectzero·CVSS 7.4
[HIGH] A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby
Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user. One such feature is audio transcription. Incoming SMS and RCS audio attachments received by Google Messages are now automatically decoded with no user interaction. As a result, audio decoders are now in the 0-click attack surface of most Android phones.
Iâve spent a fair bit of time investigating these decoders, first reporting CVE-2025-49415 in the Monkeyâs Audio codec on Samsung devices. Based on this research, the team reviewed the Dolby Unified Decoder, and Ivan Fra
2025-12-11
Published