Google Patches Pixel Modem Vulnerability Linked to Targeted Attacks

Google has released security updates for Pixel smartphones after identifying a high-severity vulnerability in the devices' cellular modem that may have been exploited in limited, targeted attacks.

The vulnerability, tracked as CVE-2026-58704, involves a permission-bypass issue caused by a logic error in the modem software. Successful exploitation could allow an attacker to escalate privileges without requiring additional execution privileges or any action from the device owner.

The absence of user interaction makes the vulnerability particularly notable. An attack of this type can potentially take place without the victim clicking on a link, opening an attachment or installing an application. Google has not disclosed who may have been behind the reported exploitation or provided detailed information about the attacks.

The company addressed the vulnerability through its September 2026 Pixel security update. The update also resolves more than 100 other security issues affecting Pixel devices, including vulnerabilities involving privilege escalation, information disclosure, remote code execution and denial-of-service conditions.

Google's security bulletin states that there are indications CVE-2026-58704 may have been used in limited, targeted exploitation. The US Cybersecurity and Infrastructure Security Agency subsequently added the vulnerability to its Known Exploited Vulnerabilities catalogue.

The affected component is the cellular modem, which handles a smartphone's connection to mobile networks. Because the modem operates as a distinct part of the device's software architecture, vulnerabilities in this area can create security concerns involving access boundaries between the modem and other parts of the phone.

Google recommends that Pixel users install the latest available security update. Devices with the September 5, 2026 security patch level or later include the fix for the reported vulnerability.

16-09-2026