Overview
- Google disclosed Tuesday that its September 2026 Pixel security update fixes CVE-2026-58704 and roughly 110 other Pixel-specific vulnerabilities, and the update is rolling out to supported devices.
- The bug sits in the cellular modem and is a permission bypass caused by a logic error that can let an attacker escalate privileges without any user interaction.
- Public guidance from the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities list and directed federal civilian agencies to apply the patch by September 19, 2026.
- Google has said the exploitation was limited and targeted but has not disclosed who carried out the attacks, how many devices were hit, or which Pixel models were affected.
- Pixel users and IT managers should install the 2026-09-05 patch level now because modem flaws operate below normal app defenses and can be chained with other footholds or spyware to enable covert access.