Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks
Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.
Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.
- CVE-2026-58704 is an actively exploited modem EoP zero-day in Pixel devices
- Exploit is low-complexity, requires no user interaction, works from adjacent radio proximity
- September Pixel bulletin fixes 110 flaws, including 12 critical RCEs
- Patch level 2026-09-05 or later fully remediates the zero-day
- Pixel 6/6 Pro reach end-of-life in October 2026
- Vendors
- Organizations
- SecurityWeek
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28662 | Heap Buffer Overflow in Android Wi-Fi Direct (P2P) Provisioning Discovery Enables Nearby RCE | 8.0 | <1% | ||
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation | 8.8 | <1% | KEV | KEV |
From the original article
3 min read at cybersecuritynews.comGoogle has confirmed that a high-severity Android zero-day flaw affecting its Pixel smartphones is being actively exploited in the wild, and it has shipped emergency patches as part of the September 2026 Pixel Update Bulletin. Tracked as CVE-2026-58704, the vulnerability resides in the device Modem subcomponent and is being weaponized in what the company describes […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.