Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Google's September Pixel update patches CVE-2026-58704, a high-severity cellular modem privilege escalation flaw showing signs of limited targeted exploitation.
Google disclosed CVE-2026-58704 (CVSS 8.0), a privilege escalation flaw in the Pixel Cellular Modem caused by a logic error permitting proximal/adjacent privilege escalation with no user interaction or extra privileges needed. Google acknowledged indications the flaw may be under limited, targeted exploitation but did not identify the threat actor. The September 2026 Pixel update fixes 109 additional flaws, including 46 critical-severity issues in components such as BigOcean, Bootloader, IMS, and Trusted Execution Environment, plus two high-severity kernel privilege escalation bugs (CVE-2026-56914, CVE-2026-58773). Security patch level 2026-09-05 or later resolves all identified flaws.
- CVE-2026-58704: Pixel modem permission bypass enabling privilege escalation
- Google sees indications of limited, targeted exploitation; actor unidentified
- September update fixes 110 flaws total, including 46 rated critical
- Two high-severity kernel privilege escalation bugs also patched
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-48595 | Integer Overflow Local Privilege Escalation in Android Framework | 8.4 | 2% | KEV | KEV |
CVE-2026-56914+1 related CVE | Use-After-Free in Google Pixel Modem Enables Local Privilege Escalation | 8.4 group max | — | ||
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation | 8.8 | <1% | KEV | KEV |
From the original article
1 min read at thehackernews.comGoogle has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked as CVE-2026-58704 (CVSS score: 8. 0), is a privilege escalation flaw.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.