Google Pixel phones pwned in zero-click attacks
CISA added actively exploited zero-click Pixel modem flaw CVE-2026-58704 to its KEV catalog, giving federal agencies three days to patch.
Google disclosed CVE-2026-58704, a high-severity improper authorization flaw in Pixel phones' cellular modems that bypasses permission checks and escalates privileges with no user interaction, noting limited, targeted exploitation. CISA added it to the Known Exploited Vulnerabilities Catalog with a September 19 deadline for federal agencies. Such zero-click modem bugs are a frequent vector for commercial spyware. The Register also notes two recently KEV-listed Chromium V8 flaws, CVE-2026-85046 and CVE-2026-87491, which Proofpoint says four espionage groups chained in intrusions.
- CVE-2026-58704 is an improper authorization flaw in Pixel modems
- Exploitation is zero-click, requiring no user interaction
- CISA KEV patch deadline for federal agencies is September 19
- Zero-click modem bugs are a common commercial spyware vector
- Proofpoint tied Chromium CVE-2026-85046 to four espionage groups
- Vendors
- GoogleCISAProofpoint
- Products
- Pixel
- Organizations
- GoogleCISAProofpoint
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation | 8.8 | <1% | KEV | KEV |
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
2 min read at theregister.comBoth Google and Uncle Sam warned that attackers have exploited a zero-day improper authorization bug in Pixel phones' cellular modems that can bypass permission checks and escalate privileges with no user interaction required. The hole has since been closed, provided that you update.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.