Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation

Key Points:

• Google disclosed a high-severity privilege escalation vulnerability (CVE-2026-58704, CVSS 8.0) in its Pixel Cellular Modem that is actively being exploited in the wild without requiring user interaction.
• The flaw stems from a logic error allowing remote attackers near the device to bypass permission checks and escalate privileges silently, enabling zero-click attacks.
• Alongside CVE-2026-58704, Google patched 109 other security issues in the September 2026 Pixel update, including critical vulnerabilities in kernel and other system components that could lead to privilege escalation and remote code execution.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by September 19, 2026.
• Users are strongly advised to update their Pixel devices to the security patch level 2026-09-05 or later via Settings > Security & privacy to mitigate these risks.