Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks
Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.
Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.
- CVE-2026-58704 is an actively exploited modem EoP zero-day in Pixel devices
- Exploit is low-complexity, requires no user interaction, works from adjacent radio proximity
- September Pixel bulletin fixes 110 flaws, including 12 critical RCEs
- Patch level 2026-09-05 or later fully remediates the zero-day
- Pixel 6/6 Pro reach end-of-life in October 2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-28662 | Heap Buffer Overflow in Android Wi-Fi Direct (P2P) Provisioning Discovery Enables Nearby RCE CVE-2026-28662 is a heap buffer overflow causing an out-of-bounds write in p2p_process_prov_disc_bootstrap_req in p2p_pd.c, the code that handles Wi-Fi P2P (Wi-Fi Direct) provisioning discovery bootstrap requests in Android's Wi-Fi stack. It is triggered when a nearby attacker sends a crafted bootstrap request over the air while the device's Wi-Fi is enabled; no user interaction or privileges are required. Successful exploitation yields remote (proximal/adjacent) code execution, meaning anyone within Wi-Fi radio range could run code on the device. Android devices running software prior to the September 2026 Android Security Update are affected. Exploitation is not currently observed: there is no public proof-of-concept, it is not in CISA's KEV, and EPSS puts 30-day exploitation probability at about 0.1%. Do: Install the September 2026 Android Security Update (or your device vendor's equivalent build) as soon as it is available and verify the patch level in Settings > About phone. Until patched, consider disabling Wi-Fi Direct/peer-to-peer sharing and Wi-Fi when not needed, since exploitation requires proximity. The patch is part of the September 2026 release that fixes 180 vulnerabilities in total. | 8.0 | <1% |
| massorder of billions of Android devices worldwide carry the affected Wi-Fi Direct code, though exploitation requires an attacker within radio range | ||
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation A logic error in the cellular modem component causes an improper authorization check (CWE-285/CWE-693), allowing a permission bypass. An attacker who already has low privileges and is on an adjacent network (proximal, e.g., a hostile local or cellular-adjacent network) can trigger the flaw without any user interaction, and successful exploitation yields remote escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.0). The flaw was assigned through Google's device security CNA ([email protected]), consistent with modem firmware shipped in Google Pixel-class devices; specific affected firmware versions were not provided in the source data. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and there is no evidence of exploitation in the wild. Defenders should treat this as a patch-on-next-bulletin item unless devices operate in high-risk adjacent-network environments. Do: Install the latest Google monthly security update that includes the cellular modem firmware patch and verify the device's security patch level reflects it. Because exploitation requires network adjacency plus some existing privilege, prioritize devices used in high-risk or shared-network settings and watch for indicators of rogue femtocell/base-station or hostile local-network activity. With no public PoC or KEV listing, standard monthly patch cadence is reasonable outside those high-risk scenarios. | 8.0 | — | KEV |
| masstens of millions of devices (≈10M+ active Pixel-class handsets worldwide) |
Full article652 words · extracted from cybersecuritynews.com · click to collapse
Google has confirmed that a high-severity Android zero-day flaw affecting its Pixel smartphones is being actively exploited in the wild, and it has shipped emergency patches as part of the September 2026 Pixel Update Bulletin.
Tracked as CVE-2026-58704, the vulnerability resides in the device Modem subcomponent and is being weaponized in what the company describes as “limited, targeted” attacks. Users are urged to move to the 2026-09-05 security patch level without delay.
Android Pixel 0-Day Exploited
The bug is an elevation-of-privilege (EoP) weakness rooted in improper authorization and a protection-mechanism failure within the cellular modem.
According to the advisory, “In Cellular Modem, there is a possible permission bypass due to a logic error in the code,” which “could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed”.
In plain terms, an attacker positioned on an adjacent network, someone within radio proximity of the target who already holds basic privileges on the device, can quietly elevate their access.
What makes CVE-2026-58704 particularly concerning is how little the attack demands. Google notes the exploit is low-complexity and requires no user interaction, meaning a victim does not need to tap a link, install an app, or make any mistake for the intrusion to succeed.
Flaws in the modem layer are especially prized by sophisticated actors because they sit close to the baseband and can serve as a stealthy stepping stone toward deeper device compromise.
The “limited, targeted” language Google uses is the same phrasing it has historically applied to zero-days leveraged by commercial spyware vendors and state-aligned surveillance operators, suggesting a narrow but high-value victim set rather than mass exploitation.
CVE-2026-58704 did not arrive alone. According to the official advisory released by Google, the September 2026 Pixel bulletin, published on September 15, patches a total of 110 vulnerabilities on Pixel hardware, including 12 remote code execution and 89 privilege-escalation issues rated critical or high.
Several critical-severity RCE flaws affect components such as the IP Multimedia Subsystem, libpixelimsmedia, the VPU, the Modem, and the BigOcean media engine, while a long list of bootloader, Trusted Execution Environment, and Titan-security-related components received critical EoP fixes.
Because Pixel devices run Google-controlled hardware, they receive a dedicated bulletin separate from the broader Android Security Bulletin distributed to other OEMs.
The Pixel patches build on the wider September 2026 Android update, which SecurityWeek reported addressed roughly 180 vulnerabilities across the ecosystem, including dozens of critical flaws such as the Wi-Fi memory-corruption bug CVE-2026-28662.
Google issued two patch strings this month, 2026-09-01 and 2026-09-05, with the latter level closing out every applicable September fix plus prior outstanding issues.
Any security patch level of 2026-09-05 or later fully remediates CVE-2026-58704 and every other issue in the bulletin, and all supported Google devices are receiving the update. That supported roster spans the Pixel 6 series through the newly launched Pixel 11 family, along with the Pixel Tablet and Fold models.
Owners of the aging Pixel 6 and 6 Pro should note that those handsets reach end-of-life in October 2026, making this one of their final guaranteed security refreshes.
To install the update, Pixel users should open Settings, navigate to Security & privacy, then System & updates, tap Security update, select Install, and restart the device to complete the process.
Firmware images are also available on the Google Developer site for advanced users who prefer manual flashing.
Given confirmed exploitation, applying this patch should be treated as urgent rather than routine, especially for journalists, executives, activists, and other individuals who fall within the typical targeting profile of proximal, zero-click modem exploits.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/android-pixel-zero-day/