Android Zero-Day on Google Pixel Devices Actively Exploited, Patches Released
Google has issued emergency patches for CVE-2026-58704, a zero-day vulnerability in Pixel devices that allows for remote privilege escalation.
Google has confirmed that a critical zero-day vulnerability affecting its Pixel smartphones is being actively exploited in the wild. The flaw, tracked as CVE-2026-58704, resides within the device's modem subcomponent and has been weaponized in "limited, targeted" attacks, according to Google's advisory.
The vulnerability is an elevation-of-privilege (EoP) flaw stemming from improper authorization and a protection mechanism failure within the cellular modem. Specifically, a logic error allows for a permission bypass, which could lead to remote escalation of privilege from an adjacent network with no additional execution privileges required. This means an attacker in radio proximity to a target device, who already possesses basic privileges, can silently increase their access level.
What makes CVE-2026-58704 particularly concerning is its low complexity and lack of user interaction requirement. Attackers do not need victims to click links or install malicious applications for the exploit to succeed. Vulnerabilities within the modem layer are highly sought after by sophisticated threat actors, including state-aligned groups and commercial spyware vendors, as they offer a stealthy entry point for deeper device compromise.
The "limited, targeted" nature of the attacks, as described by Google, suggests a narrow but high-value victim set rather than widespread exploitation. This phrasing is consistent with past zero-day disclosures linked to advanced persistent threats and espionage operations.
CVE-2026-58704 was addressed as part of the September 2026 Pixel Update Bulletin, which shipped on September 15. This bulletin patches a total of 110 vulnerabilities affecting Pixel hardware, including 12 remote code execution and 89 privilege-escalation issues rated critical or high. Several critical RCE flaws impacted components like the IP Multimedia Subsystem, libpixelimsmedia, VPU, Modem, and BigOcean media engine.
The Pixel patches are built upon the broader September 2026 Android Security Bulletin, which addressed approximately 180 vulnerabilities across the Android ecosystem. Google released two patch strings for September: 2026-09-01 and 2026-09-05. The latter security patch level, 2026-09-05 or later, fully remediates CVE-2026-58704 and all other issues detailed in the bulletin.
All supported Google Pixel devices, including the Pixel 6 series through the latest Pixel 11 family, as well as the Pixel Tablet and Fold, are receiving these updates. Users of the Pixel 6 and 6 Pro should note that these devices reach their end-of-life in October 2026, making this one of their final guaranteed security refreshes.
Given the confirmed exploitation, users are strongly urged to apply the September 5, 2026 security patch level immediately. The update can be installed by navigating to Settings > Security & privacy > System & updates > Security update. For advanced users, firmware images are available on the Google Developer site. This patch is particularly critical for individuals who may be targeted by sophisticated actors, such as journalists, executives, and activists.
This new report from Malwarebytes Labs provides further details on CVE-2026-58704, a vulnerability affecting the cellular modem component of Google Pixel devices. The article elaborates on the potential exploitation chain, suggesting that attackers may need adjacent network access and basic privileges on the targeted device, and that this flaw could be chained with other exploits for deeper compromise. It also clarifies that this specific fix is for Pixel devices and not necessarily for other Android manufacturers.
This new report from The Hacker News provides further details on the CVE-2026-58704 vulnerability affecting Google Pixel devices. It specifies the flaw as a privilege escalation issue stemming from a logic error in the Cellular Modem's code, allowing for a potential permission bypass. Google has confirmed that this vulnerability has seen limited, targeted exploitation in the wild.