CVE-2026-58704: Google Pixel Modem Zero-Day Exploited in Targeted Attacks

Google has released security updates for a high-severity zero-day vulnerability affecting the cellular modem in Pixel devices after finding signs that the flaw is being used in limited, targeted attacks. Tracked as CVE-2026-58704 and scored 8.0 under CVSS 3.1, the issue can allow an attacker to bypass permission checks and escalate privileges without requiring any interaction from the device owner.

The vulnerability results from a logic error in the cellular modem that causes improper authorization. Google’s CVE description says exploitation can lead to remote, proximal or adjacent privilege escalation with no additional execution privileges needed, and the attack does not require the victim to tap a link, open a document, or approve a prompt.

That zero-click characteristic significantly raises the operational risk. Unlike common mobile attacks that depend on social engineering, a modem-level vulnerability may potentially be triggered through communications processed below the normal application layer, reducing the opportunities for users to recognize or stop an attack before exploitation occurs. Google has not publicly described the delivery mechanism used in the observed campaign.

The September 2026 Pixel update fixes the vulnerability with security patch level 2026-09-05 or later. Google says all supported Pixel devices will receive the update and urges users to install it.

CVE-2026-58704 analysis

The flaw exists in the Pixel Cellular Modem and is described as a permission bypass caused by a logic error. CISA’s vulnerability enrichment maps the weakness to improper authorization and protection-mechanism failure, reflecting a situation in which security checks do not correctly enforce the privilege boundary expected by the modem software.

The most important details for CVE-2026-58704 are contained in its attack characteristics. The available CVSS data assigns an adjacent-network attack vector, low attack complexity, no required user interaction, and high potential impact to confidentiality, integrity, and availability.

This means exploitation should not be interpreted like a typical vulnerability in an internet-facing web service. An attacker must operate through a communication path considered proximal or adjacent to the vulnerable modem environment. Google has not publicly described whether the attacks rely on a malicious cellular base station, manipulated carrier traffic, another modem-facing mechanism, or a different delivery technique.

CVE-2026-58704 affects the Android kernel/modem implementation identified in Google’s Pixel security bulletin. Google does not provide a model-by-model vulnerable-device table for this specific CVE, but the September bulletin states that all supported Google Pixel devices receive security patch level 2026-09-05 to address the issues covered by the update.

The privilege-escalation impact is significant because the cellular modem operates at a lower level than ordinary Android applications. A successful attacker may be able to cross security boundaries that are normally inaccessible to standard application code, potentially gaining additional access to device resources or creating a foothold for a broader exploit chain.

Google has not explained the exact privileges obtained after successful exploitation, nor has it described what the attackers did after triggering the vulnerability. As a result, claims that the flaw independently provides complete Pixel device compromise, spyware installation, or Android root access would go beyond the evidence currently available.

SecurityWeek notes that modem-level, zero-click exploitation combined with Google’s wording about “limited, targeted exploitation” resembles patterns historically associated with sophisticated surveillance operations. However, Google has not attributed the attacks to a commercial spyware vendor, state-sponsored actor, or any other specific threat group.

Google publicly disclosed the vulnerability in its September 2026 Pixel Update Bulletin, published September 15. The exact date on which Google or the original researcher first identified the vulnerability has not been made public in the bulletin or the two cited reports.

The September Pixel release is much broader than this single zero-day. Google addressed more than 100 Pixel-specific vulnerabilities, including numerous privilege-escalation, remote code execution, information disclosure, and denial-of-service issues across components such as the modem, bootloader, IP Multimedia Subsystem, Trusted Execution Environment, Bluetooth, NFC, pKVM, and other Pixel subsystems.

Google nevertheless singled out CVE-2026-58704 in the bulletin by explicitly warning that there are indications of limited, targeted exploitation. None of the other flaws in the bulletin received the same exploitation warning.

A public CVE-2026-58704 PoC has not been identified in Google’s advisory or the two requested reports. Google has also not released technical details sufficient to reproduce the attack, which is consistent with the sensitivity of a vulnerability currently being exploited against selected targets.

Likewise, Google has not published campaign-specific CVE-2026-58704 IOCs such as malicious domains, phone numbers, infrastructure, payload hashes, base-station identifiers, or modem telemetry patterns. This makes conventional indicator-based hunting difficult and places greater emphasis on patch status and mobile-device telemetry.

On September 16, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, confirming that exploitation is no longer based solely on a vendor suspicion. U.S. Federal Civilian Executive Branch agencies were given until September 19, 2026 to apply the security update.

The short remediation period reflects the combination of confirmed exploitation, lack of required victim interaction, and the sensitive position of the cellular modem in the device architecture.

CVE-2026-58704 Mitigation

The primary remediation is straightforward: install the latest Google Pixel security update and verify that the device reports a security patch level of 2026-09-05 or later. Google states that this patch level addresses every vulnerability listed in the September Pixel bulletin.

Pixel users can check for updates through:

Settings → Security & privacy → System & updates → Security update

Menu wording can vary slightly depending on the Pixel model and Android release, but users should verify the final Android security patch level rather than assuming an update has been installed simply because the device recently restarted.

Organizations managing Pixel devices through enterprise mobility management or mobile device management should confirm patch deployment centrally. Devices belonging to executives, government personnel, journalists, security researchers, defense-sector employees, or other individuals who may face targeted mobile exploitation deserve particularly fast remediation.

CVE-2026-58704 detection is challenging because Google has not released exploit-specific indicators. Security teams should therefore begin by identifying Pixel devices that have not reached the September 5 security patch level and prioritizing them according to user risk and exposure.

To Detect CVE-2026-58704 exploitation or suspicious follow-on activity, defenders can review available mobile security and network telemetry for:

• Pixel devices remaining below the 2026-09-05 security patch level
• Unexpected modem or cellular subsystem crashes
• Repeated loss and restoration of cellular connectivity without an operational explanation
• Unusual baseband or telephony events preceding suspicious device activity
• Unexpected privilege changes or security alerts on a Pixel endpoint
• Suspicious processes or applications appearing after anomalous cellular behavior
• Unexpected outbound communication following unexplained modem events
• New device-administrator or accessibility permissions that the user did not authorize
• Unusual account access or credential use following suspected mobile compromise

These behaviors are investigative leads rather than definitive signatures for the zero-day. Google has not disclosed enough information about the exploit chain to identify a unique network or endpoint pattern.

Organizations should also avoid overstating what conventional Android EDR can observe. Because the vulnerability resides in the cellular modem, relevant exploitation activity may occur below the visibility available to ordinary applications and many mobile security agents.

For high-risk individuals whose devices were unpatched during the known exploitation period, patching should be combined with a review for broader compromise if other suspicious signs are present. Updating fixes the vulnerable code path but cannot retroactively determine whether

Key Takeaways

• CVE-2026-58704 is a Google Pixel modem zero-day vulnerability exploited in targeted attacks, enabling attackers to compromise device baseband communications on affected Pixel devices.
• Modem-level vulnerabilities are particularly severe as they operate below the operating system security layer, potentially allowing attackers to intercept calls, messages, and cellular data.
• Pixel device users should apply the September security update immediately and be aware that modem-level exploitation may evade standard endpoint detection and response tools.