Understanding the kinetics of passive oxide formation and breakdown has been an ongoing problem for corrosion scientists for several decades. Here, we present a model for the formation of a passive oxide film on a metal that is an extension of the Point Defect Model (PDM) by Macdonald and coworkers. We replace the potential description of the PDM with a boundary value problem and ensure that Gauss's law is satisfied at the oxide-solution interface by considering the presence of the Helmholtz layer in solution. Our model predicts the observed linear variation of the steady-state film thickness with anode potential, and an increasing film thickness with increasing pH. We perform a linear stability analysis of the model and show that, depending on the parameters, the passive film may be unstable to morphological perturbations of the film interfaces, leading to nonplanar films and potentially the formation of a pit in the oxide. This also implies that one-dimensional models, which assume planar interfaces, can be inapplicable in broad classes of corrosion processes. The analysis shows that a morphological instability exists if the oxide dissolution mechanism is such that an increasing Helmholtz layer potential drop leads to an increasing dissolution rate. The instability behavior is consistent with the literature on breakdown of passivity in the presence of chloride ions. The theory provides insights on the initiation of passivity breakdown leading to pitting corrosion and the role that interfacial energy plays in determining stability. (c) 2019 Elsevier Ltd. All rights reserved.