Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Google's September Pixel update patches CVE-2026-58704, a high-severity cellular modem privilege escalation flaw showing signs of limited targeted exploitation.
Google disclosed CVE-2026-58704 (CVSS 8.0), a privilege escalation flaw in the Pixel Cellular Modem caused by a logic error permitting proximal/adjacent privilege escalation with no user interaction or extra privileges needed. Google acknowledged indications the flaw may be under limited, targeted exploitation but did not identify the threat actor. The September 2026 Pixel update fixes 109 additional flaws, including 46 critical-severity issues in components such as BigOcean, Bootloader, IMS, and Trusted Execution Environment, plus two high-severity kernel privilege escalation bugs (CVE-2026-56914, CVE-2026-58773). Security patch level 2026-09-05 or later resolves all identified flaws.