Google Patches Zero-Click Modem Flaw in Pixel Phones

Overview

• Google released the September 2026 Pixel security update on Wednesday, Sept. 16, 2026, and it includes a fix for the high-severity cellular modem bug tracked as CVE-2026-58704.
• The flaw is a logic error in the Pixel cellular modem that can bypass modem permissions to escalate privileges without any user interaction, a so-called zero-click vulnerability.
• Google says there are indications the bug was exploited in limited, targeted attacks but the company has not named who carried out the attacks or how many devices were affected.
• Security agencies and reporters have urged Pixel users and administrators to install the 2026-09-05 security patch level or later immediately to close the exploit and protect managed fleets.
• Modem-level bugs run below Android's app defenses, attract sophisticated actors and commercial spyware vendors, and the defect was added to CISA's Known Exploited Vulnerabilities list, raising urgency for monitoring and rapid patching.