Google fixed a Pixel modem vulnerability that was already used in attacks

Google released its September security update for Pixel smartphones and fixed CVE-2026-58704 in the cellular modem. On the CVSS scale it scored 8.0 out of 10 — a high severity level. The company says there are indications of limited, targeted exploitation of this flaw.

The issue is a logic error in the modem code that bypasses a permission check. It allows privilege escalation, and without any action by the device owner: no additional rights are required for exploitation, and no user involvement is needed.

The attack does not come over the internet, however. The vector is classified as adjacent: to reach the vulnerable modem environment, an attacker needs to be near the device. In practice this narrows the pool of potential targets, but it does not make the flaw harmless.

The modem is a sensitive component responsible for connecting the device to mobile networks. Vulnerabilities in it have historically drawn attention: they operate below most of Android's security model and offer a path to privileged access without malicious apps or phishing.

Google, as usual, does not disclose who exactly exploited the vulnerability, how many devices were attacked, or what goals were pursued. The bulletin points to neither a specific group nor a developer of commercial spyware. The limited nature of the exploitation suggests it was unlikely to have been mass-scale.

CVE-2026-58704 is only one of many flaws fixed in the September Pixel release: the list also includes the kernel, bootloader, telephony stack, GPU, Bluetooth, NFC and other components. The fix is part of the September 5, 2026 security patch level. Owners of supported Pixel devices should install the update: confirmation of real-world exploitation changes the risk assessment.

Image: Google Public domain

Translation editors: Соловьев В., Пеков А.