Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched Pixel modem zero-day CVE-2026-58704 (CVSS 8.0), exploited in limited targeted attacks, enabling adjacent privilege escalation without user interaction.
Google's September 2026 Pixel security update fixes CVE-2026-58704, a CVSS 8.0 permission bypass caused by a logic error in the cellular modem, allowing remote (proximal/adjacent) elevation of privilege with no user interaction or additional privileges. Google confirms indications of limited, targeted exploitation in the wild but provides no attribution, target count, or attack objectives. The modem location is significant because it operates below much of the Android application security model. The bulletin also patches multiple critical RCE flaws in IMS, libpixelimsmedia, VPU, modem, telephone and BigOcean components, with the 2026-09-05 patch level protecting devices.
- CVE-2026-58704 is a CVSS 8.0 permission bypass in the Pixel cellular modem
- Exploitation needs no user interaction and yields adjacent privilege escalation
- Google confirms limited, targeted exploitation but names no attacker
- September bulletin also fixes critical RCE flaws in IMS, VPU, BigOcean
- 2026-09-05 patch level protects devices; fleet patching strongly advised
- CVEs
- CVE-2026-58704
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation | 8.8 | <1% | KEV | KEV |
From the original article
3 min read at securityaffairs.comGoogle has patched a high-severity zero-day in the Pixel cellular modem after finding evidence that the vulnerability was exploited in limited, targeted attacks. Google has released its September 2026 Pixel security update, addressing a large set of vulnerabilities, including a high-severity flaw, tracked as CVE-2026-58704 (CVSS score of 8. 0), in the cellular modem that has […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.