Indias cybersecurity agency CERT-In has sent out a warning to people who use Android smartphones. This is because Google has fixed a security problem with the Dolby audio parts on Android devices. Here is what you need to do: if your phone is waiting for a security update from January 2026 you should install it away. The problem with the phone is that someone can use it to run code from far away under certain conditions. This can even happen without you doing anything, which is called a “zero-click” attack. Security researchers and news reports have talked about this kind of attack. So people who use Android smartphones should install the update soon as possible. CERT-In is warning Android smartphone users to do this because it is very important, for the security of their phones.

1) What CERT-In is warning people about. Why this warning is important, to us

The Indian Computer Emergency Response Team, which is also known as CERT-In is the group that helps the Government of India deal with cybersecurity problems and tells the public about security issues. When the Indian Computer Emergency Response Team or CERT-In says something is “critical” for things, like Android that people use every day the Indian Computer Emergency Response Team or CERT-In is trying to warn us about something.

The problem is very common. It affects a lot of devices not just one or two special kinds.

The impact can be serious (device takeover, data theft, etc.),

The best way to stay safe is to fix problems away. This is because people who use computers cannot change settings to get around a problem with the software. The software has a flaw. That is what needs to be fixed. Immediate patching is the defense against this kind of problem, with the software.

So in this situation CERT-In gave a warning after Google fixed some problems with Dolby on Android devices. There were news stories, about this saying that if people do not fix their devices bad people could run code on them or even take control of the Android devices. This is a deal because it affects the Android devices that have Dolby.

2) The vulnerability in simple terms: “Dolby decoder” bug

Smartphones can play lots of kinds of media like music and video and voice notes and audio, in messaging apps. To play these media files smartphones use something called codecs or decoders. These are basically software programs that figure out what the media data means and turn it into sound that we can hear. Smartphones really need these codecs to work properly so we can listen to our music. Watch our videos.

The problem that people are talking about in these reports is connected to a part of Dolby. This is usually called the Dolby Digital Plus Unified Decoder. Sometimes the words used to describe it are a little different. This issue is known as CVE-2025-54957 in a lot of security reports that talk about it. The Dolby Digital Plus issue is what people are worried, about.

Why decoder bugs can be “critical”

A media decoder deals with files and streams that come from all sorts of places. These can be messages things we download from the web files that people share with us and even stuff that is embedded apps. If the media decoder has a problem like it does not handle memory safely then someone can make an audio file that can cause trouble. This special audio file can sometimes trigger problems, with the media decoder.

a crash (denial of service),

information leak,

or worst case: arbitrary code execution (running attacker-controlled code on your phone).

Decoder vulnerabilities are a deal and that is why they are treated as a high priority. The people, in charge consider decoder vulnerabilities to be very important. So decoder vulnerabilities get a lot of attention because they can cause problems.

3) “Zero-click”. That is when you do not have to click on anything. The thing that happens with “zero-click” is that it does something without you having to do any clicking all on the “zero-click” thing. So “zero-click” is really, about not clicking.

There are a lot of reports about the Dolby bug. The Dolby bug is called “zero-click” which means someone who wants to hurt you does not need you to click on a link or open a file like you normally do. Some apps or parts of your system might automatically look at media like when you want to see a preview of something or when your system is trying to keep track of your files or when it is trying to understand voice notes and things like that. The Dolby bug is still a problem, in these situations.

Something important to remember: “Zero-click” does not mean that someone can magically hack into any phone away. It usually means that the iPhone or Android phone can be hacked without the owner of the phone doing anything like clicking on a link. Zero-click is a type of hacking that can happen without the phone user taking any action such, as clicking on something. This is what Zero-click really means not that it can instantly hack any phone.

The attacker needs to get the media files to you in some way like, through a message or when you get a file from them.

A vulnerable component has to figure out what the information means so the vulnerable component can do this on its own. The vulnerable component is very important here because the vulnerable component is the one that has to parse the information without any help.

The device and the app must have protection that does not stop the device and the app from being exploited by someone. The protection, for the device and the app should allow exploitation to happen.

If people who do research and the people who write the patch notes say something is critical you should think that it is a risk. This is especially true for people like journalists, executives and activists. It is also true, for people who put a lot of apps on their devices and deal with a lot of media files. These people should be careful because they are more likely to be targeted. If researchers and patch notes say something is critical you should listen to them. Think about the risk that media files and apps can pose to your device.

4) Timeline: when the problem was found and when the problem was fixed

From coverage and security writeups:

The problem with the flaw became known, to everyone after Google researchers found it around October 2025. These Google researchers are often talked about in reports when it comes to Androids security patches.

Google made some security updates. These updates were part of the January 2026 Android Security Bulletin. This bulletin says that if you have patch levels 2026-01-05 or later the Google Android security issues are fixed. The Android Security Bulletin from Google is what tells us this. Google says that the patch levels, from 2026-01-05 or later take care of the problems that were found in the Google Android system.

The advisory, from CERT-In and Indian tech news articles came out soon after that. They told people to update their phones. This is what CERT-In and the Indian tech news articles said to the users of phones.

It is also worth noting that Pixel devices often get fixes before phones. This is because Google can send updates directly to Pixel devices. Other Android phone brands may take longer to get these updates. This is because they have their schedules for sending out updates. Google publishes the Android bulletin and the Pixel bulletin, at times.

5) Who does this affect?

Potentially affected: many Android devices with Dolby components

The warning is for people who use Android. It seems like the problem is with a part of Dolby that is used in different devices and brands. This is especially true for devices that come with Dolby audio enhancements and related codec libraries. The problem with the Dolby component is what is causing the issue, for Android users.

The exact exposure is different, for a lot of things. It varies by:

Android version,

device chipset / firmware,

The computer has an original equipment manufacturer build.

and whether the Dolby decoder component (and the vulnerable version) is present.

People who write about security issues say that this is a weakness in a part of the Dolby decoder. The Android Security Bulletin also has some information about Dolby that is related to the patch. This patch is meant to fix some problems with the Dolby decoder component. Security writeups are talking about the vulnerability, in the Dolby decoder component.

The risk you actually face in the real world changes with how fast things get updated. Real-world risk is something that you have to think about when you are looking at how updates happen. If updates happen fast then the real-world risk is different than if updates happen slowly.

Two people can own Android phones in the month but there are some things to think about when this happens with Android phones. For example two people who own Android phones might have experiences, with their Android phones. The way they use their Android phones can be very different.

* They might use their Android phones for things

* They might have Android phones.

So even if two people own Android phones in the month their Android phones can still be used in different ways.

Person A has a phone that got the 2026-01-05 patch quickly so the phone is protected now. The phone got the 2026-01-05 patch. That means the phone is safe.

Person B has a phone that’s not up to date which means it might be at risk until the company that made the phone the OEM puts out a new update, for it.

This is the reason why CERT-In gives simple advice: people should update their things right away update immediately. CERT-In wants everyone to update immediately.

6) What could a bad person do if you do not update your software? If you do not update a bad person could do some bad things. They could get into your computer system. Take control of it.

The bad person could also steal your information like your name and address. Use it to do bad things.

You should always update your software so that the bad person cannot get into your system and hurt you or your computer.

If you update your software it will be much safer. The bad person will not be able to do bad things to you or your computer.

Reports tell us about the impact in ways, like:

execute arbitrary code,

gain unauthorized access,

potentially “take control” of the device in some scenarios.

So when we have code execution vulnerabilities what kind of problems do we usually see happening because of them? We should think about the things that happen when code execution vulnerabilities are used in a bad way. Successful code execution vulnerabilities can cause a lot of issues.

For example successful code execution vulnerabilities can lead to problems. We need to think about what successful code execution vulnerabilities can do to our systems. Successful code execution vulnerabilities are very bad for our computers and our information.

We have to consider what successful code execution vulnerabilities can do. Successful code execution vulnerabilities are not good. They can cause problems, with our computers and our information. Successful code execution vulnerabilities need to be fixed so they do not cause problems.

Possible outcomes

Data theft is a problem. An attackers code could try to get to the files that are stored on your device. This includes your photos, messages and the information that apps store.. It is worth noting that Android has something called sandboxing and it also has permissions that can stop this from happening. So the attackers code can only do what Android allows it to do with the files, photos, messages or app data.

Account compromise is a problem. If bad software can read the codes that are used to get into your account that is not good. It is also not good if the bad software can trick you into giving it access to your account. This means the bad software can do things with your account that you do not want it to do. Account compromise is something that can happen if you are not careful, with your account and the secret codes that are used to get into it.

When it comes to spyware installation advanced attackers can use a series of exploits to get what they want. They might find one bug that lets them get a foothold on a system. Then they use another bug to escalate their privileges on that system. This is how spyware installation happens, by using these bugs to get more access to the spyware installation target. The attackers keep using the spyware installation bugs until they have control, over the spyware installation.

Surveillance is something that really gets to me. When we talk about surveillance we are talking about things like microphones and cameras being used to monitor people. This kind of surveillance typically needs a lot of permissions to work.. The thing is bad people often use malware that targets specific people. They usually try to trick people into doing something that lets them get access to their devices. After they get in they use engineering to get what they want from the surveillance like from the microphone or camera monitoring. Surveillance, like this is really scary because it is an invasion of our privacy.

When it comes to persistence if attackers manage to get privileges they can stay on the system even after it restarts.. If they do not get these high privileges the attackers may have a hard time staying on the system and they may be limited in what they can do. The persistence of the attackers is really important because it determines how long they can stay on the system and keep doing damage.

Key point

So even if it is not easy for someone to take advantage of a problem the best thing to do is still to patch. The big issues, with media decoders are exactly what bad people look for because media goes to many places. Media decoder bugs are bad news because media is everywhere. You have to patch these media decoder bugs.

7) So you want to know how Googles Android patching works and why your phone may not have the updates yet. Googles Android patching is a thing where they fix problems with the system. The reason your phone may not have it yet is because Googles Android patching takes some time to get to every phone. Googles Android patching has to go through a lot of steps before it gets to your phone.

Google puts out security fixes in the Android Security Bulletin this includes:

framework/system fixes,

kernel fixes,

Sometimes the company has to fix problems, with parts that other people made which is something that Dolby usually has to deal with.

Most phones do not run Googles generic Android builds. The manufacturers add things to the Android that Google makes. They do this because the Android that Google makes is not what the manufacturers want to give to the people who buy their phones. The manufacturers want to make the Android their own so they add things to it. This means that the Android on phones is not the same, as the generic Android that Google makes. Manufacturers add lots of things to the Android.

custom UI,

device-specific drivers,

camera stacks,

audio enhancements,

carrier requirements.

So the path is usually:

Google publishes a bulletin. Then the manufacturer of your phone also known as the OEM integrates the fixes into their system. After that they do some testing to make sure everything works properly. If everything is okay the carrier and the OEM work together to roll out the update. Finally Google updates reach your phone. You receive an over the air update, from Google.

That is why your update might arrive days or weeks after the bulletin is published. The update for the bulletin can be slow to arrive. Your update, for the bulletin might take a time to get to you.

8) How to check if your computer is patched, which is the way to do it

The Android Security Bulletin says that if you have a security patch level of 2026-01-05 or later then the Android Security Bulletin says you do not have to worry about the problems that were found with that security patch level. The Android Security Bulletin is talking about the Android Security Bulletin security patch levels. So the Android Security Bulletin is saying that the Android Security Bulletin security patch levels of 2026-01-05 or later fix the issues with the Android Security Bulletin security patch levels.

To make sure everything is up, to date we need to check the patch level. This means we have to follow a simple steps.

First we check the level of the software we are using.

The patch level is very important because it tells us if the software has the updates.

We have to check the patch level to keep the software running and to fix any problems that might be there.

So we will check the software patch level.

Settings

About phone (or “About device”)

Android version

Look for Android security patch level

If the date is 2026-01-05 or something newer the January 2026 patch set that is described in the bulletin will work for the January 2026 patch set.

Step-by-step: update now

The menus are not all the same for every brand. Menus, for these brands are generally similar.

Settings

System

Software update / System update

Tap Check for updates

Download and install

If you see that there is an update available but you keep putting it off then this is the time to go ahead and install the update.

9) What if your phone says it is up to date. The patch level of your phone is actually older? This is a problem with the patch level of your phone because your phone says it is up to date. The patch level of your phone is what matters, not what your phone says about being to date. So even if your phone says it is up, to date you should still check the level of your phone.

This happens a lot. When something says it is “up to date” it really means that there is “no update for your model yet”. I have seen this with the software updates for my computer, where it says “up to date” but what it actually means is that they have not made any updates, for my model.

If your security patch level is older than 2026-01-05 you can still do things to reduce the risk of something happening while you are waiting for an update, to your security patch level.

Things to do to reduce risk until we get a patch

* Check everything is up, to date

* Be careful what we click on

* Make sure we have good security software

Risk reduction is very important until the patch arrives

We need to keep doing these things to reduce risk until the patch arrives

Be cautious with unsolicited media: don’t accept random files from unknown senders.

When you update your apps the Play Store updates can not fix the problems with the system decoder.. They do make it harder for people to attack your phone. This is because the updates fix problems in apps, like messaging apps and media apps and so on.

To stop downloads, in messaging apps you should go into the settings of WhatsApp, Telegram and other similar apps. You need to look for the option that lets you control what gets downloaded automatically especially when it comes to media files. The way to do this can be a bit different depending on the app you are using.

Avoid installing APKs from unknown sources (sideloading).

Enable Google Play Protect and keep it on.

Restart regularly: not a fix, but can disrupt some non-persistent malware (not advanced spyware).

These steps are “seatbelts,” not a cure. The cure is the system update.

10) Why CERT-In’s advice is urgent: media bugs age badly

Security vulnerabilities often follow an arc: they are discovered people talk about them and then they get fixed. Security vulnerabilities can be a problem. When Security vulnerabilities happen they can cause a lot of trouble. People who find Security vulnerabilities usually tell others about them so that something can be done.

* Security vulnerabilities are found by people who look for these kinds of problems

* These people tell others about the Security vulnerabilities they found

Security vulnerabilities are a deal because they can be used to do bad things. This is why it is so important to fix Security vulnerabilities when they are found.

People who study things like researchers they find these things. Then they tell everyone about them the researchers do. They discover them. Then they write it down or say it out loud so others know the researchers find and report them.

The vendors patch things to fix problems with the vendors patch. This is what the vendors patch does it helps the vendors patch work. The vendors patch is important for the vendors patch to be safe and secure.

People find out about the patch details. Sometimes they even get some technical hints about the patch details. The patch details are out in the open for everyone to see which is really, about the patch details.

Attackers reverse-engineer patches to build exploits

Devices that are not updated become targets as time goes on. This is because unpatched devices are more vulnerable to attacks. Unpatched devices are like doors that can be easily broken into. Over time unpatched devices become bigger targets, for people who want to cause harm.

When Google fixes a problem and people find out about it that is when the clock starts ticking for everyone who does not update Google. This means people who do not update Google are, at risk. The clock starts for people who do not take care of the Google update.

Agencies like CERT-In give out warnings to a lot of people. They do this because they want everyone to fix the problems before someone takes advantage of them. This is a reason they do it. They want the public to be safe before someone tries to exploit the issues. It becomes a big problem. Agencies, like CERT-In’re trying to help people by telling them to patch their systems.

11) What manufacturers and enterprises should do

Manufacturers and enterprises should really think about what they need to do.

The first thing manufacturers and enterprises need to consider is how to make their products better.

Manufacturers and enterprises have to work to make this happen.

They need to talk to each other and figure out what manufacturers and enterprises can do to help each other.

This is very important for manufacturers and enterprises to succeed.

Manufacturers and enterprises should also try to learn from their mistakes and use that to improve what manufacturers and enterprises are doing.

By doing this manufacturers and enterprises will be able to make products and provide good services to their customers, which is what manufacturers and enterprises want.

If you are in charge of taking care of devices for a company or a school or if you are the person who handles technology for your familys phones you should think of this as an important update. You should really pay attention to this update if you manage devices for a company or a school. It is crucial for people who are known as the person, for their familys phones.

For organizations (MDM / enterprise)

Enforce minimum Android patch level (ideally 2026-01-05 or later for this cycle).

We need to monitor compliance. This means we have to look at devices that still need to be updated. Some devices remain unpatched. That is a problem. We have to segment these devices, the devices that remain unpatched so we can keep an eye on them. The devices that remain unpatched are a priority because they are not safe. We have to check the devices that remain unpatched to make sure they are updated.

Restrict risky channels: disable unknown sources, restrict file sharing apps if possible.

When we are talking about incident readiness we need to be prepared for anything that seems suspicious. This means that if we notice something weird is going on with our devices like the battery is draining fast or there are unknown accessibility services running or there is unusual network traffic happening we have to take a closer look, at it right away. We need to figure out what is going on with the incident readiness and take care of it quickly. Incident readiness is very important. We should always be ready to check on these things, like battery drain or unusual network traffic and do something about them.

For consumers managing family phones

Check patch level on everyone’s phone.

Update all devices.

If a device is not getting updates anymore you should think about getting an one. The security of the device is really important. It matters more than some small things it can do. Security support is what keeps your device safe so it is more important, than feature differences. If your device is no longer receiving updates security support is what you should be thinking about.

12) FAQs (quick answers)

Is this only for Pixel phones?

No. The bulletin is for Android in general. This means it is, for all Android devices. However Pixels usually get the fixes before devices. The time it takes for other companies to release the fixes can be different.

I want to know if I need to install an update for the Dolby app. Do I really need to get an update, for the Dolby app to make it work properly?

Normally this is not something you have to do. The Google people and the people who made your phone usually take care of this with system security updates from Google and the phones manufacturer.

So I am wondering if the antivirus software can fix this problem with my computer. Will the antivirus be able to remove the virus and make my computer work properly again? Can the antivirus really fix this issue that I am having?

Antivirus is good at finding things like malware that we already know about but it is not very good at stopping people from using a bug in the system to do bad things. The only way to really fix this problem is to get a patch. A patch is like a fix for the computer that makes it safe from the bug. So the patch is the solution, to this problem.

If I do not use Dolby features then I want to know if I am safe when it comes to Dolby features. I mean what happens if I do not use Dolby features all will I still be safe, from any problems related to Dolby features?

It is not necessary that you have to use Dolby for this to happen. If the vulnerable decoder library is, on your device then it can be used by apps or the system even if you do not use Dolby. The decoder library can still be invoked, whether you use Dolby or not.

13) Here is what you should do now. This is a list of the things to do.

* Take action on the things that’re important to you

* Make a plan for the things that you need to do

* Start working on the things that you have been putting off

The things to do right now are the things that will help you achieve your goals. So you should focus on the things that’re most important, to doing well. Remember, the best things to do now are the things that will help you get ahead.

Install the latest system update available on your phone.

Confirm your Android security patch level (aim for 2026-01-05 or later for the January 2026 patch set).

Update all apps from Play Store.

Turn off auto-download of media in messaging apps (optional but helpful).

If your phone is stuck on very old patch levels with no updates coming, plan an upgrade when possible.