Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched Pixel modem zero-day CVE-2026-58704, a zero-click permission bypass enabling remote privilege escalation, exploited in targeted attacks.
CVE-2026-58704 is a high-severity logic error in the Pixel cellular modem allowing remote (proximal/adjacent) escalation of privilege with no user interaction or additional execution privileges. Google reports limited, targeted exploitation but has not attributed it; the zero-click modem nature suggests commercial spyware or state-sponsored actors. The September Pixel update also fixes more than 100 other Pixel-specific vulnerabilities, nearly 50 of them critical, enabling RCE or privilege escalation.
- Modem permission bypass requires no user interaction and no additional execution privileges.
- No threat actor attribution; limited, targeted exploitation acknowledged by Google.
- Update bundle includes current Android security patches and fixes to multimedia, bootloader, TEE, and modem components.
- CVEs
- CVE-2026-58704
- Vendors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation | 8.8 | <1% | KEV | KEV |
From the original article
1 min read at securityweek.comGoogle announced patches for the exploited privilege escalation vulnerability (CVE-2026-58704) on September 15. The post Pixel Modem Zero-Day Exploited in Targeted Attacks appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.