Most people understand that clicking a bad link or opening a suspicious attachment can get your phone hacked. What most people do not know is that a whole category of attacks requires you to do absolutely nothing. No click, no tap, no download. Your device gets compromised simply because it received a message or a signal. These are called zero click exploits, and they are among the most dangerous vulnerabilities in existence.

A zero click exploit takes advantage of a flaw in how a device processes incoming data automatically. Your phone constantly receives data without your involvement: text messages, push notifications, calendar invites, image previews, network packets. Every one of those processes involves software, and software has bugs. A zero click exploit finds a bug in one of those automatic processes and uses it to run malicious code on your device before you ever see the incoming content.

The reason these attacks are so dangerous is precisely because there is nothing for the user to avoid doing. Security advice like do not click unknown links, do not open attachments from strangers, only download from trusted sources is completely useless against a zero click attack. You cannot opt out of receiving a text message or a push notification.

The Pixel 10 vulnerability currently trending on Hacker News is a zero click exploit chain, meaning it is not a single bug but a sequence of bugs chained together. An attacker exploits the first bug to gain limited access, uses that access to trigger the second bug for more access, and continues until they have full control of the device. Chained exploits are significantly harder to develop but also significantly more powerful because each link in the chain bypasses a different security layer.

Google has built multiple security systems into Android and Pixel devices specifically to prevent this kind of attack. The fact that researchers found a working chain anyway tells you two things. First, modern smartphones are extraordinarily complex systems with enormous attack surfaces. Second, the security research community is doing its job by finding these vulnerabilities before malicious actors weaponize them.

If you own a Pixel 10, check your settings for a pending security update and install it immediately. Google typically patches critical vulnerabilities within days of responsible disclosure. The patch is the fix. Until it is installed, your device remains vulnerable to an attack you would never see coming.