Project Zero releases a 0-click exploit chain for the Pixel 9.

[evacide@hachyderm.io]

Project Zero releases a 0-click exploit chain for the Pixel 9. This one targets the Pixel, but the 0-click bug and exploit techniques used also apply to most other Android devices.

https://projectzero.google/2026/01/pixel-0-click-part-1.html

[alex02@elonsucks.org]

@evacide nice. an exploit pegasus will prolly use.

[tadbithuman@mastodon.social]

@evacide
Does that impact GrapheneOS mods?

[fishercat@kolektiva.social]

@evacide I'm an end user.

From skimming the parts of the article I can understand, my takeaway is that having turned off every AI "feature" and never using the transcription tool on my Android device reduces its vulnerability to this particular 0-click exploit chain. Is that accurate?

[emory@soc.kvet.ch]

@alex02 @evacide in the US we're using another vendor as far as i understand it pegasus isn't state of the art anymore.

[emory@soc.kvet.ch]

@alex02 @evacide not to discourage you or anything you're right that jailbreaks and other exploitation of mobile devices is absolutely the least resistance path for clandestine compromise against friendlies.

[kookie64@tech.lgbt]

@tadbithuman @evacide looks like the Dolby side of things was patched in the January 2026 ASB, which is included in the latest version of GrapheneOS.
https://source.android.com/docs/security/bulletin/2026/2026-01-01#dolby

[newstik@social.heise.de]

@evacide "Incoming SMS and RCS audio attachments received by Google Messages are now automatically decoded with no user interaction." Is there a way to turn that off? (Asking for those who have not yet switched to an alternate SMS app.)

[newstik@social.heise.de]

@Fishercat @evacide Not necessarily. According to the report, the audio-decoding is automatic. The user turning things off may only turn off the *display* of the result.

Better to switch to a different, more old-school SMS app. There are plenty. I *think* that would help.

[fishercat@kolektiva.social]

@newstik @evacide I use Signal, and routinely block microphone access unless I'm using it. I don't always remember to turn it off, afterwards, though.