Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched Pixel modem zero-day CVE-2026-58704, a zero-click permission bypass enabling remote privilege escalation, exploited in targeted attacks.
CVE-2026-58704 is a high-severity logic error in the Pixel cellular modem allowing remote (proximal/adjacent) escalation of privilege with no user interaction or additional execution privileges. Google reports limited, targeted exploitation but has not attributed it; the zero-click modem nature suggests commercial spyware or state-sponsored actors. The September Pixel update also fixes more than 100 other Pixel-specific vulnerabilities, nearly 50 of them critical, enabling RCE or privilege escalation.
- Modem permission bypass requires no user interaction and no additional execution privileges.
- No threat actor attribution; limited, targeted exploitation acknowledged by Google.
- Update bundle includes current Android security patches and fixes to multimedia, bootloader, TEE, and modem components.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation A logic error in the cellular modem component causes an improper authorization check (CWE-285/CWE-693), allowing a permission bypass. An attacker who already has low privileges and is on an adjacent network (proximal, e.g., a hostile local or cellular-adjacent network) can trigger the flaw without any user interaction, and successful exploitation yields remote escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.0). The flaw was assigned through Google's device security CNA ([email protected]), consistent with modem firmware shipped in Google Pixel-class devices; specific affected firmware versions were not provided in the source data. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and there is no evidence of exploitation in the wild. Defenders should treat this as a patch-on-next-bulletin item unless devices operate in high-risk adjacent-network environments. Do: Install the latest Google monthly security update that includes the cellular modem firmware patch and verify the device's security patch level reflects it. Because exploitation requires network adjacency plus some existing privilege, prioritize devices used in high-risk or shared-network settings and watch for indicators of rogue femtocell/base-station or hostile local-network activity. With no public PoC or KEV listing, standard monthly patch cadence is reasonable outside those high-risk scenarios. | 8.0 | — | KEV |
| masstens of millions of devices (≈10M+ active Pixel-class handsets worldwide) |
Full article258 words · extracted from securityweek.com · click to collapse
Google on Tuesday informed Pixel phone owners that it has patched a zero-day vulnerability exploited in targeted attacks.
The zero-day is tracked as CVE-2026-58704, and Google said it’s aware of “limited, targeted exploitation”.
The vulnerability has been rated high severity and affects the Pixel’s modem component.
“In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation,” reads the CVE record for CVE-2026-58704.
Google has not attributed the exploitation to a specific threat actor, but the modem-level, zero-click nature of the flaw and the company’s ‘limited, targeted’ framing are hallmarks of past attacks linked to commercial spyware vendors or state-sponsored actors.
The latest Pixel updates also include the most recent Android security patches. They also resolve more than 100 other vulnerabilities that are specific to Pixel devices.
Advertisement. Scroll to continue reading.
Nearly 50 vulnerabilities have critical severity, enabling remote code execution or privilege escalation. The critical flaws affect the multimedia subsystem, VPU, modem, telephone, bootloader, TEE, libpixelimsmedia, GDMC, GSA, GPCA, and other components.
Most of the remaining vulnerabilities are high severity, and exploiting them can lead to remote code execution, privilege escalation, information disclosure, and denial of service (DoS).
Related: Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews
Related: How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones
Related: What’s Hiding in Your Mobile Apps? Lookout MSEC Aims to Find Out
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.securityweek.com/pixel-modem-zero-day-exploited-in-targeted-attacks/