CVE-2026-56914

CVE-2026-56914 is a use-after-free condition caused by improper locking in multiple code locations in the modem component of Google Pixel smartphones, per Google's security bulletin coverage. An attacker can trigger the freed-memory race condition without needing any user interaction and without holding additional execution privileges. Successful exploitation yields local escalation of privilege on the affected device. All Pixel devices running firmware that predates Google's fix are potentially affected, with the specific impacted models and build numbers not enumerated in the available data. There is no public proof-of-concept and the flaw is not in CISA's KEV catalog, but Google's patch release is accompanied by reports of signs of limited, targeted exploitation.

What to do: Install the latest Pixel/Android security bulletin update (Settings > System > System update) on all Pixel devices, prioritizing high-risk users such as journalists, executives, and government personnel given reports of targeted exploitation, and verify the security patch level after updating. No reliable mitigation is available beyond patching, since the flaw requires no user interaction or special privileges. Track Google's Pixel security bulletin for the definitive list of affected models and builds.