Pixel 9 Zero-Click Exploit: How a Single Audio Message Can Compromise Your Phone

Fri, 16 Jan 2026 10:25:26 +0100

Someone sends you an audio message. You don’t open it, you don’t play it, you don’t even look at your phone. And you’re already hacked. 😏 Google Project Zero just published a three-part series this week showing exactly how they built a working exploit chain for the Pixel 9. No clicks required and no interaction at all. Just receive a message and your phone is compromised.

CVE-2025-54957

The vulnerability sits in Dolby’s audio decoder, a component that ships on almost every Android phone sold today. Pixel, Samsung, and dozens of other brands all use it. When someone sends you an audio message through SMS or RCS (the default messaging on most Android phones), your phone automatically decodes it for transcription. Before you even see the notification, the malicious code is already running.

Your iPhone Just Got Owned: iOS WebKit Zero-Days Require No Click (CVE-2025-43529)

Mon, 12 Jan 2026 12:12:00 +0100

Your iPhone can be compromised by loading a webpage. No click. No download. Just visit the wrong site. Apple patched this a month ago. Only 16% of users have updated. 🤔

StatCounter data from January 2026:

→ iOS 26 (all versions): 16% of iPhones

→ iOS 18 (unpatched): over 60% of iPhones

For comparison, iOS 18 reached 63% adoption by January 2025. iOS 26 is at less than one quarter of that rate. The lowest adoption Apple has seen in years.

Mobile Security on HackingPassion.com : root@HackingPassion.com-[~]

Pixel 9 Zero-Click Exploit: How a Single Audio Message Can Compromise Your Phone

Your iPhone Just Got Owned: iOS WebKit Zero-Days Require No Click (CVE-2025-43529)