Google Pixel Modem Flaw CVE-2026-58704 Exploited in Targeted Attacks
- Severity
- HIGH
- Affected component
- google (other)
- Patched version
- Not yet available
Google Pixel devices are affected by a high-severity improper authorization vulnerability in the cellular modem. The flaw, tracked as CVE-2026-58704, allows privilege escalation and is actively exploited in targeted attacks.
What happened
Google has disclosed a high-severity security flaw in its Pixel Cellular Modem, tracked as CVE-2026-58704. This vulnerability, with a CVSS score of 8.0, is a privilege escalation flaw due to a logic error in the code. It could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation. Google has acknowledged that CVE-2026-58704 may be under limited, targeted exploitation but has not disclosed further details about the attacks or the threat actor.
The vulnerability was first flagged on September 16, 2026, and confirmed on the same day. It is listed in the CISA Known Exploited Vulnerabilities Catalog. Google has released security updates to address this and other vulnerabilities, with security patch levels of 2026-09-05 or later resolving the identified flaws.
What to do about it
- Upgrade to the latest version of the Google Pixel firmware.
- Monitor for any security advisories related to CVE-2026-58704.
- Ensure that your device is running the latest security patch levels.
- Stay informed by following updates from trusted sources such as Google, CISA, and cybersecurity news platforms.
How 0Day would have caught this
google is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using a Google Pixel device, you may be affected by this vulnerability. However, no authoritative version range has been published yet.
What should I do right now?
Upgrade to the latest version of the Google Pixel firmware and monitor for any security advisories.
Has this been exploited in the wild?
Yes, CVE-2026-58704 is confirmed to be exploited in targeted attacks.