Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks

CISA confirms active exploitation of the Pixel flaw

Google has patched a high-severity vulnerability in the Pixel Cellular Modem after finding indications of limited, targeted exploitation.

The flaw, tracked as CVE-2026-58704, can allow an attacker to bypass permission checks and elevate privileges without user interaction. Google has not disclosed the targets, attack infrastructure, exploitation method, or the purpose of the observed activity.

On September 16, 2026, the US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog. CISA reserves that catalog for security defects supported by evidence of exploitation, making the issue an immediate operational risk rather than a theoretical weakness.

Federal Civilian Executive Branch agencies must remediate CVE-2026-58704 by September 19, 2026. Other organizations are not bound by that deadline, but CISA encourages them to prioritize KEV-listed vulnerabilities in risk-based patching programs.

Google rates the vulnerability as high severity. Its reported CVSS score is 8.0, with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

A logic error breaks modem permission checks

CVE-2026-58704 is an improper authorization vulnerability caused by a logic error in cellular-modem code. The error can permit an attacker to bypass expected permission checks and obtain elevated access.

The available description characterizes the route to exploitation as remote, proximal, or adjacent. The CVSS vector similarly uses an adjacent attack vector, AV:A, rather than the network-wide AV:N designation.

That distinction matters. The vulnerability should not be interpreted as an unrestricted Internet attack against every reachable Pixel phone. Exploitation apparently requires access through a nearby, logically adjacent, or cellular-related environment, but Google has not identified the precise radio interface, protocol, network position, or modem condition needed to reach the defective code.

Attack complexity is rated low, while user interaction is not required. A victim would not need to open a document, follow a link, install an application, or approve a prompt. This makes the flaw potentially usable in a zero-click attack.

The published vector includes PR:L, indicating low privileges are required in the scoring model. Google’s description also says exploitation does not require additional execution privileges. Without a technical analysis or exploit chain, it is not known what initial access or attacker-controlled position satisfies those conditions.

The impact metrics assign high consequences for confidentiality, integrity, and availability. However, no public account explains exactly what privileges an attacker gains or whether the observed operations combined the modem flaw with other vulnerabilities.

Modem-level weaknesses are particularly sensitive because the cellular subsystem operates beneath much of Android’s application-facing security model. An attack reaching that layer may avoid the malicious-application and phishing routes commonly monitored by mobile security controls.

Exact affected Pixel models have not been disclosed

Google identifies Pixel devices and the Pixel Cellular Modem as affected, but exact models, firmware builds, and vulnerable product versions have not been published in the available vulnerability record.

The practical remediation marker is the security patch level. Supported Pixel devices showing the 2026-09-05 security patch level or later contain fixes for the Pixel bulletin issues and the corresponding Android security release.

Users can check for updates through Settings > Security & privacy and the available update controls. Fleet administrators should verify the reported patch level rather than assuming that an update was installed merely because it was downloaded or scheduled.

The broader Pixel release is substantial. It addresses 109 other security defects: 88 privilege-escalation vulnerabilities, 10 information-disclosure issues, nine remote-code-execution flaws, and two denial-of-service vulnerabilities. Of those additional issues, 46 are reported as critical.

Affected areas across the release include the modem, bootloader, telephony stack, IP Multimedia Subsystem, Trusted Execution Environment, VPU, GPU, Bluetooth, NFC, pKVM and proprietary Pixel components. Critical remote-code-execution defects were reported in components including the IP Multimedia Subsystem, libpixelimsmedia, VPU, modem, telephone and BigOcean.

Two other high-severity kernel privilege-escalation issues are CVE-2026-56914, scored 7.8, and CVE-2026-58773, scored 6.7. Neither is identified as the zero-day behind Google’s targeted-exploitation warning.

The victims and attack chain remain unknown

Google’s wording indicates limited, targeted use rather than widespread exploitation. CISA’s KEV decision confirms that the evidence was sufficient to classify CVE-2026-58704 as actively exploited.

Beyond those findings, attribution remains open. Google has not named a threat group, commercial surveillance vendor, state sponsor, or criminal operator. The number of affected devices, geographic distribution of victims and objectives of the attacks are also unknown.

No evidence establishes whether the modem vulnerability was exploited by itself. It may have formed one stage of a larger chain, but no sandbox report, forensic reconstruction, proof-of-concept code, or technical exploit analysis has been made public.

The combination of modem access, zero-click behavior and narrowly targeted activity resembles characteristics sometimes seen in sophisticated mobile surveillance operations. That is context, not attribution. There is currently no basis for assigning this campaign to a private spyware company or government-linked group.

There are also no confirmed indicators of compromise, detection signatures, malicious domains, file hashes, modem logs, or device artifacts specific to CVE-2026-58704. Consequently, defenders cannot rely on a simple indicator-matching exercise to determine whether a phone was targeted.

The KEV deadline requires patching and compromise assessment

For CVE-2026-58704, CISA directs agencies to apply vendor mitigations while complying with BOD 26-04, Prioritizing Security Updates Based on Risk, and its Forensics Triage Requirements. Agencies must also evaluate each asset’s Internet exposure and follow the directive’s patching guidance.

If mitigations cannot be applied, CISA’s required action is to discontinue use of the affected product. Relevant BOD 26-04 requirements also apply to cloud services where applicable.

The forensic component is significant. Installing an update closes the known vulnerability, but it does not determine whether exploitation occurred before remediation. Agencies should assess possible compromise as part of the response rather than treating patch deployment as the end of the investigation.

This is not Google’s only recent appearance in KEV. During the preceding 90 days, CISA also added CVE-2026-87491 on September 9, 2026, and CVE-2026-85046 on September 4, 2026, for the same vendor.

An earlier Android issue, CVE-2025-48595, entered KEV on June 2, 2026, with a federal remediation deadline of June 5, 2026. That separate Android 14 integer-overflow vulnerability carried a CVSS score of 8.4 and could enable code execution and local privilege escalation without user interaction.

What Pixel users and security teams should do

Individual Pixel owners should install the latest supported security update and confirm that the device reports a patch level of 2026-09-05 or later. Devices that no longer receive supported updates should not be assumed safe from the flaw.

Enterprise defenders should inventory every managed Pixel device, collect its model and patch level, and accelerate deployment to users most exposed to targeted surveillance. Priority groups may include government personnel, executives, journalists, researchers and others handling sensitive information.

Where compromise is plausible, teams should preserve available mobile-device-management records, security telemetry, device logs and relevant network or carrier-side data before routine troubleshooting destroys context. Unexplained modem or telephony behavior, abnormal reboots and suspicious privilege transitions may justify investigation, but they are not confirmed indicators of this vulnerability.

Organizations should also document devices that were active before receiving the update. That exposure window can guide triage when no vulnerability-specific detection signature exists.

The most reliable defensive action is patch verification. CVE-2026-58704 has been exploited, requires no victim interaction, and affects a component with privileged access to cellular functions. Waiting for public exploit code or fuller attribution would leave targeted devices exposed without providing a defensive advantage.