Google patches Pixel modem flaw exploited in limited targeted attacks

September 16, 2026 at 04:15 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Google disclosed that a high-severity flaw in its Pixel Cellular Modem, tracked as CVE-2026-58704, has been exploited in limited, targeted attacks. The September 2026 Pixel update fixes the vulnerability along with 109 other security flaws. Google did not share details on the nature of the attacks or the threat actor behind them.

Key Facts

CVE-2026-58704 is a privilege escalation flaw in the Pixel Cellular Modem with a CVSS score of 8.0.
Google's September 2026 Pixel update addresses 110 security flaws, including 88 privilege escalation and 9 remote code execution vulnerabilities.
Security patch level 2026-09-05 or later resolves all identified flaws.
In June 2026, Google patched CVE-2025-48595, an actively exploited high-severity flaw in Android's Framework component.

The Vulnerability

The flaw, CVE-2026-58704, is a privilege escalation vulnerability in the Pixel Cellular Modem with a CVSS score of 8.0. According to the NIST National Vulnerability Database, the bug is a possible permission bypass due to a logic error in the code. Exploitation could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed and no user interaction required.

Exploitation and Response

In an advisory issued Tuesday, Google acknowledged indications that CVE-2026-58704 may be under limited, targeted exploitation. Google did not share further details about the nature of the attacks or the identity of the threat actor behind them. The September 2026 Pixel update resolves the flaw along with 109 other security vulnerabilities. Users are advised to update their devices to the latest version via Settings > Security & privacy.

Update Details

The update includes fixes for 88 privilege escalation, 10 information disclosure, 9 remote code execution, and 2 denial-of-service vulnerabilities. Two high-severity privilege escalation flaws in Kernel components (CVE-2026-56914 and CVE-2026-58773) are also addressed. Additionally, 46 critical-severity vulnerabilities in Pixel components such as BigOcean, Bootloader, IP Multimedia Subsystem, and Trusted Execution Environment are fixed. Security patch level 2026-09-05 or later resolves all identified flaws.