Overview
- The Android 17 QPR1 September update includes a fix for CVE-2026-58704, a logic error in Pixel modems that allowed remote, zero-click privilege escalation.
- Google said the vulnerability was actively used in limited, targeted attacks before the patch was released.
- Public sources do not say which Pixel models or how many users were affected because vendors and the NVD are restricting technical information.
- Pixel owners should install the September security update now by opening Settings, going to System, and choosing Software update to protect their device.
- The bug shows how modem code can hide deep logic errors that let attackers bypass Android protections and access sensitive device data if left unpatched.