Google patches actively exploited Pixel modem zero-day CVE-2026-58704 in September 2026 update

CVE-2025-48595 is an integer overflow (CWE-190) in the Android Framework, present in multiple locations, that can be triggered by code already running locally on the device with no additional execution privileges and no user interaction required. A local attacker, such as a malicious or compromised app, who triggers the overflow can achieve code execution with elevated privileges, yielding a local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.4, local attack vector). The flaw affects the Android Framework component of Google's Android operating system, so it applies broadly across the Android device ecosystem; specific affected version ranges were not published in the available data. Google fixed the flaw in its June 2026 Android security update, which patched 124 flaws overall, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-02, with news coverage confirming it is being actively exploited in the wild. No public proof-of-concept is known, but confirmed in-the-wild exploitation makes patching urgent.

Do: Apply Google's June 2026 Android security update (or later) to all Android devices as soon as the OEM build is available, and verify the device's 'Android security patch level' reads June 2026 or later before treating it as remediated. US federal agencies must remediate within the BOD 22-01 timelines per the KEV listing. Because exploitation requires local code execution, prioritize devices on which users can install or run untrusted apps, and use MDM tooling to track patch compliance across managed fleets.

CVE-2026-28662 is a heap buffer overflow causing an out-of-bounds write in p2p_process_prov_disc_bootstrap_req in p2p_pd.c, the code that handles Wi-Fi P2P (Wi-Fi Direct) provisioning discovery bootstrap requests in Android's Wi-Fi stack. It is triggered when a nearby attacker sends a crafted bootstrap request over the air while the device's Wi-Fi is enabled; no user interaction or privileges are required. Successful exploitation yields remote (proximal/adjacent) code execution, meaning anyone within Wi-Fi radio range could run code on the device. Android devices running software prior to the September 2026 Android Security Update are affected. Exploitation is not currently observed: there is no public proof-of-concept, it is not in CISA's KEV, and EPSS puts 30-day exploitation probability at about 0.1%.

Do: Install the September 2026 Android Security Update (or your device vendor's equivalent build) as soon as it is available and verify the patch level in Settings > About phone. Until patched, consider disabling Wi-Fi Direct/peer-to-peer sharing and Wi-Fi when not needed, since exploitation requires proximity. The patch is part of the September 2026 release that fixes 180 vulnerabilities in total.

CVE-2026-56914 is a use-after-free condition caused by improper locking in multiple code locations in the modem component of Google Pixel smartphones, per Google's security bulletin coverage. An attacker can trigger the freed-memory race condition without needing any user interaction and without holding additional execution privileges. Successful exploitation yields local escalation of privilege on the affected device. All Pixel devices running firmware that predates Google's fix are potentially affected, with the specific impacted models and build numbers not enumerated in the available data. There is no public proof-of-concept and the flaw is not in CISA's KEV catalog, but Google's patch release is accompanied by reports of signs of limited, targeted exploitation.

Do: Install the latest Pixel/Android security bulletin update (Settings > System > System update) on all Pixel devices, prioritizing high-risk users such as journalists, executives, and government personnel given reports of targeted exploitation, and verify the security patch level after updating. No reliable mitigation is available beyond patching, since the flaw requires no user interaction or special privileges. Track Google's Pixel security bulletin for the definitive list of affected models and builds.

A logic error in the cellular modem component causes an improper authorization check (CWE-285/CWE-693), allowing a permission bypass. An attacker who already has low privileges and is on an adjacent network (proximal, e.g., a hostile local or cellular-adjacent network) can trigger the flaw without any user interaction, and successful exploitation yields remote escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.0). The flaw was assigned through Google's device security CNA ([email protected]), consistent with modem firmware shipped in Google Pixel-class devices; specific affected firmware versions were not provided in the source data. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and there is no evidence of exploitation in the wild. Defenders should treat this as a patch-on-next-bulletin item unless devices operate in high-risk adjacent-network environments.

Do: Install the latest Google monthly security update that includes the cellular modem firmware patch and verify the device's security patch level reflects it. Because exploitation requires network adjacency plus some existing privilege, prioritize devices used in high-risk or shared-network settings and watch for indicators of rogue femtocell/base-station or hostile local-network activity. With no public PoC or KEV listing, standard monthly patch cadence is reasonable outside those high-risk scenarios.

CVE-2026-58773 is an out-of-bounds write (CWE-787) in link_load_gnss_image of link_device.c, the modem link device driver in the Android kernel used on Google Pixel phones, where a missing bounds check allows memory corruption when a GNSS image is loaded. To trigger it, an attacker must already have System-level code execution on the device; no user interaction is required. Successful exploitation corrupts memory outside the intended bounds and can yield local escalation of privilege, effectively moving an attacker from System context to higher (kernel-level) privileges. The flaw affects Google Pixel devices running the affected modem link driver, so exposure is limited to attackers who have already compromised a device or an app with System privileges. No public proof-of-concept exists and the bug is not in CISA KEV, but reporting indicates signs of limited, targeted exploitation, so it should be treated as exploited in the wild.

Do: Install the latest Google Pixel security update that addresses CVE-2026-58773 as soon as it is offered (Settings > System > System update), and verify the Android security patch level under Settings > About phone. Because exploitation requires System execution privileges and reporting suggests targeted misuse, prioritize high-risk users such as executives, journalists, and government personnel. There is no known remote mitigation; patching is the effective fix.