Google says some Pixel phone owners were hacked in zero-day attacks
Google patched CVE-2026-58704, a zero-click Pixel modem privilege-escalation zero-day exploited in limited, targeted attacks.
Google disclosed that a vulnerability in Pixel smartphones' modem software, tracked as CVE-2026-58704, was exploited in limited and targeted cyberattacks and has now been patched. Exploitation could allow an attacker to escape the modem sandbox and escalate privileges to access broader phone data. The bug can be exploited silently with zero user interaction. Google did not attribute the activity, though such modem bugs are commonly abused by surveillance vendors selling spyware to governments.
- CVE-2026-58704 is a modem flaw enabling sandbox escape and privilege escalation on Pixel phones
- Zero-click exploitation requires no victim interaction
- Patched by Google as of the September 2026 Pixel update
- Attribution not disclosed; surveillance vendor abuse considered likely
- CVEs
- CVE-2026-58704
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58704 | Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation | 8.8 | <1% | KEV | KEV |
From the original article
1 min read at techcrunch.com
The Pixel phone maker said there are indications that a bug in the phone's modem "may be under limited, targeted exploitation."
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.