Google Pixel: 25 Vulnerabilities Disclosed, Including Actively Exploited Modem Flaw
Google disclosed 25 vulnerabilities in Pixel smartphones on September 15, 2026, including an actively exploited modem flaw.
Key findings
- 25 vulnerabilities disclosed for Google Pixel devices on September 15, 2026.
- Multiple vulnerabilities allow for privilege escalation and remote code execution.
- CVE-2026-58704, a modem vulnerability, was actively exploited in targeted attacks.
- The batch includes flaws affecting cellular modems, bootloaders, and multimedia decoders.
- Google has patched these vulnerabilities, urging users to update their devices.
On September 15, 2026, Google disclosed a significant batch of 25 vulnerabilities affecting its Pixel smartphones. The vulnerabilities, all disclosed on the same day, span a range of severities from Medium to High, with several posing a risk of privilege escalation and remote code execution. Notably, one of these vulnerabilities, CVE-2026-58704, was identified as being under limited, targeted exploitation in the wild, prompting its inclusion in CISA's Known Exploited Vulnerabilities (KEV) Catalog.
The disclosed vulnerabilities impact various components of the Pixel devices. Several high-severity flaws, including CVE-2026-58704, CVE-2026-58683, CVE-2026-58704, and CVE-2026-56920, are related to improper input validation or logic errors that could lead to remote code execution or privilege escalation. For instance, CVE-2026-58704, affecting the Cellular Modem, allows for permission bypass and privilege escalation without user interaction. Similarly, CVE-2026-58683 in the IP Multimedia Subsystem and CVE-2026-56920 in HEVC decoding present risks of remote code execution due to out-of-bounds writes.
Other vulnerabilities focus on local privilege escalation. CVE-2026-58744 and CVE-2026-56945, for example, are tied to improper input validation and confused deputy issues, respectively, leading to local privilege escalation. Memory corruption due to race conditions is highlighted in CVE-2026-58728 and CVE-2026-56923. Information disclosure vulnerabilities, such as CVE-2026-58731 and CVE-2026-55304, stem from uninitialized data or logic errors, potentially exposing sensitive data.
The batch also includes vulnerabilities related to the bootloader and setup wizard. CVE-2026-58678, a permission bypass in the bootloader, could lead to privilege escalation with system execution privileges. CVE-2026-57012, a missing permission check in the Setup Wizard, allows for remote package installation and privilege escalation.
Google has addressed these vulnerabilities through its regular security update process. While specific patch versions for each CVE are not detailed, users are urged to ensure their Pixel devices are updated to the latest security patch level to mitigate these risks. The active exploitation of CVE-2026-58704 underscores the importance of timely patching, especially for vulnerabilities that may be targeted by malicious actors.
This coordinated disclosure of 25 vulnerabilities highlights the ongoing security challenges in complex mobile ecosystems. Users of Google Pixel devices should remain vigilant and apply security updates promptly to protect against potential exploitation of these flaws. The presence of actively exploited vulnerabilities in this batch serves as a critical reminder for users to prioritize security updates.