Google confirms Pixel phones exploited via cellular modem zero-day
Google says a high-severity flaw in the Pixel's cellular modem, CVE-2026-58704, saw limited targeted exploitation before this week's patch. The bug lets a nearby attacker escalate privileges with no user interaction.
Google's September 2026 security bulletin confirms CVE-2026-58704, an 8.0-severity permission-bypass flaw in the Pixel cellular modem, may have seen limited, targeted exploitation before being patched. The flaw allows an attacker on an adjacent network to escalate privileges with no user interaction and no extra execution rights needed. Google has not disclosed which Pixel models were targeted or who was behind the attacks. It was one of 110 vulnerabilities fixed in this month's Pixel update, including 12 rated for full remote code execution and 89 for privilege escalation at critical or high severity.