A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave

Article by Seth Jenkins about exploiting a use-after-free in the driver for BigWave — an AV1 decoding hardware component present on Pixel SOCs.

Seth used the bug to escalate privileges from the mediacodec SELinux context and obtain root on Pixel 9.

This exploit is a part of an RCE chain developed by Seth and Natalie Silvanovich.