Overview
- Google rolled out its September 2026 Pixel security update on Wednesday, addressing 110 Pixel-specific vulnerabilities and including a fix for CVE-2026-58704.
- CVE-2026-58704 is a modem permission-bypass logic error that can let an attacker achieve privilege escalation from an adjacent or proximal network with no user interaction.
- Google reported indications the modem bug was used in limited, targeted exploitation and has not publicly attributed the attacks or disclosed how many devices were affected.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and Google advised all supported Pixel devices to move to the 2026-09-05 patch level and restart to apply the fix.
- Modem-level zero-days operate below Android app protections and can be chained with other footholds to reach full compromise, so device owners and administrators should patch Pixels now and monitor for further technical or attribution details.