CVE-2026-58704: Google Pixel Modem Zero

Google has released security updates for a high-severity zero-day vulnerability affecting the cellular modem in Pixel devices after finding signs that the flaw is being used in limited, targeted attacks. Tracked as CVE-2026-58704 and scored 8.0 under CVSS 3.1, the issue can allow an attacker to bypass permission checks and escalate privileges without requiring any interaction from the device owner. The vulnerability results from a logic error in the cellular modem that causes improper authorization. Google’s CVE description says exploitation can lead to remote, proximal or adjacent privilege escalation with no additional execution privileges needed, and the attack does not require the victim to tap a link, open a document, or approve a prompt. That zero-click characteristic significantly raises the operational risk. Unlike common mobile attacks that depend on social engineering, a modem-level vulnerability may potentially be triggered through communications processed below the normal application layer, reducing the opportunities for users to recognize or stop an attack before exploitation occurs. Google has not publicly described the delivery mechanism used in the observed campaign. The September 2026 Pixel update fixes the vulnerability with security patch level 2026-09-05 or later. Google says all supported Pixel devices will receive the update and urges users to install it. CVE-2026-58704 analysis The flaw exists in the Pixel Cellular Modem and is described as a permission bypass caused by a logic error. CISA’s vulnerability enrichment maps the weakness to improper authorization and protection-mechanism failure, reflecting a situation in which security checks do not correctly enforce the privilege boundary expected by the modem software. The most important details for CVE-2026-58704 are contained in its attack characteristics. The available CVSS data assigns an adjacent-network attack vector, low attack complexity, no required user interaction, and high potential impact to confidentiality, integrity, and availability. This means exploitation should not be interpreted like a typical vulnerability in an internet-facing web service. An attacker must operate through a communication path considered proximal or adjacent to the vulnerable modem environment. Google has not publicly described whether the attacks rely on a malicious cellular base station, manipulated carrier traffic, another modem-facing mechanism, or a different delivery technique. CVE-2026-58704 affects the Android kernel/modem implementation identified in Google’s Pixel security bulletin. Google does not provide a model-by-model vulnerable-device table for this specific CVE, but the September bulletin states that all supported Google Pixel devices receive security patch level 2026-09-05 to address the issues covered by the update. The privilege-escalation impact is significant because the cellular modem operates at a lower level than ordinary Android applications. A successful attacker may be able to cross security boundaries that are normally inaccessible to standard application code, potentially gaining additional access to device resources or creating a foothold for a broader exploit chain. Google has not explained the exact privileges obtained after successful exploitation, nor has it described what the attackers did after triggering the vulnerability. As a result, claims that the flaw independently provides complete Pixel device compromise, spyware installation, or Android root access would go beyond the evidence currently available. SecurityWeek notes that modem-level, zero-click exploitation combined with Google’s wording about “limited, targeted exploitation” resembles patterns historically associated with sophisticated surveillance operations. However, Google has not attributed the attacks to a commercial spyware vendor, state-sponsored actor, or any other specific threat group. Google publicly disclosed the vulnerability in its September 2026 Pixel Update Bulletin, published September 15. The exact date on which Google or the original researcher first identified the vulnerability has not been made public in the bulletin or the two cited reports. The September Pixel release is much broader than this single zero-day. Google addressed more than 100 Pixel-specific vulnerabilities, including numerous privilege-escalation, remote code execution, information disclosure, and denial-of-service issues across components such as the modem, bootloader, IP Multimedia Subsystem, Trusted Execution Environment, Bluetooth, NFC, pKVM, and other Pixel subsystems. Google nevertheless singled out CVE-2026-58704 in the bulletin by explicitly warning that there are indications of limited, targeted exploitation. None of the other flaws in the bulletin received the same exploitation warning. A public CVE-2026-58704 PoC has not been identified in Google’s advisory or the two requested reports. Google has also not released technical details sufficient to reproduce the attack, which is consistent with the sensitivity of a vulnerability currently being exploited against selected targets. Likewise, Google has not published campaign-specific CVE-2026-58704 IOCs such as malicious domains, phone numbers, infrastructure, payload hashes, base-station identifiers, or modem telemetry patterns. This makes conventional indicator-based hunting difficult and places greater emphasis on patch status and mobile-device telemetry. On September 16, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, confirming that exploitation is no longer based solely on a vendor suspicion. U.S. Federal Civilian Executive Branch agencies were given until September 19, 2026 to apply the security update. The short remediation period reflects the combination of confirmed exploitation, lack of required victim interaction, and the sensitive position of the cellular modem in the device architecture. CVE-2026-58704 Mitigation The primary remediation is straightforward: install the latest Google Pixel security update and verify that the device reports a security patch level of 2026-09-05 or later. Google states that this patch level addresses every vulnerability listed in the September Pixel bulletin. Pixel users can check for updates through: Settings → Security & privacy → System & updates → Security update Menu wording can vary slightly depending on the Pixel model and Android release, but users should verify the final Android security patch level rather than assuming an update has been installed simply because the device recently restarted. Organizations managing Pixel devices through enterprise mobility management or mobile device management should confirm patch deployment centrally. Devices belonging to executives, government personnel, journalists, security researchers, defense-sector employees, or other individuals who may face targeted mobile exploitation deserve particularly fast remediation. CVE-2026-58704 detection is challenging because Google has not released exploit-specific indicators. Security teams should therefore begin by identifying Pixel devices that have not reached the September 5 security patch level and prioritizing them according to user risk and exposure. To Detect CVE-2026-58704 exploitation or suspicious follow-on activity, defenders can review available mobile security and network telemetry for: - Pixel devices remaining below the 2026-09-05 security patch level - Unexpected modem or cellular subsystem crashes - Repeated loss and restoration of cellular connectivity without an operational explanation - Unusual baseband or telephony events preceding suspicious device activity - Unexpected privilege changes or security alerts on a Pixel endpoint - Suspicious processes or applications appearing after anomalous cellular behavior - Unexpected outbound communication following unexplained modem events - New device-administrator or accessibility permissions that the user did not authorize - Unusual account access or credential use following suspected mobile compromise These behaviors are investigative leads rather than definitive signatures for the zero-day. Google has not disclosed enough information about the exploit chain to identify a unique network or endpoint pattern. Organizations should also avoid overstating what conventional Android EDR can observe. Because the vulnerability resides in the cellular modem, relevant exploitation activity may occur below the visibility available to ordinary applications and many mobile security agents. For high-risk individuals whose devices were unpatched during the known exploitation period, patching should be combined with a review for broader compromise if other suspicious signs are present. Updating fixes the vulnerable code path but cannot retroactively determine whether the device was previously targeted. If there is credible evidence that a sensitive device may have been exploited, incident response should include account-session review, credential rotation where appropriate, examination of device-management and identity-provider logs, and consideration of device replacement or forensic analysis depending on the organization’s risk level. The lack of user interaction is especially important for defensive planning. Users cannot reliably protect themselves through phishing awareness alone because the vulnerability does not require them to open malicious content. Patch deployment is therefore the essential CVE-2026-58704 mitigation measure. FAQ What is CVE-2026-58704 and how does it work? CVE-2026-58704 is a high-severity privilege-escalation vulnerability in the Google Pixel cellular modem. A logic error can cause permission checks to be bypassed, allowing an attacker using an adjacent or proximal attack path to gain additional privileges. Exploitation does not require interaction from the Pixel owner. When was CVE-2026-58704 first discovered? Google has not disclosed the original private discovery date. The vulnerability was publicly documented on September 15, 2026 in the Pixel Update Bulletin, which also revealed indications of limited, targeted exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 16. What is the impact of CVE-2026-58704 on systems? Successful exploitation can bypass modem permission controls and escalate privileges without user interaction. The available CVSS assessment rates potential confidentiality, integrity, and availability impact as high. Google has not publicly disclosed the precise post-exploitation privileges or the complete attack chain used against real-world targets. Can CVE-2026-58704 still affect me in 2026? Yes. Supported Pixel devices that have not received the September 2026 security update may remain exposed. Google has confirmed indications of limited targeted attacks, and CISA has formally classified the vulnerability as known exploited. Devices should be updated to security patch level 2026-09-05 or later. How can I protect myself from CVE-2026-58704? Install the latest Pixel update and confirm that the Android security patch level is September 5, 2026 or newer. Because exploitation requires no victim interaction and Google has not published reliable exploit indicators, rapid patching is the most important defense. High-risk organizations should additionally verify deployment through device-management tooling and investigate unusual mobile or identity activity on devices that remained unpatched.