Google patches Pixel modem zero-day used in limited targeted attacks

Google has patched a high-severity Pixel cellular-modem flaw after finding indications that it was already being used in limited, targeted attacks. The September 2026 Pixel Update Bulletin, published September 15, lists CVE-2026-58704 as an elevation-of-privilege issue in the Modem subcomponent and states plainly that there are indications the bug may be under limited, targeted exploitation. Supported Google devices moving to the 2026-09-05 security patch level or later receive the fix along with the rest of that bulletin's Pixel-specific patches.

A modem permission bypass with no tap required

NVD's description, sourced from Google Devices, says the cellular modem contains a possible permission bypass due to a logic error in the code. That can lead t

Why this patch stands out in a crowded bulletin

The September Pixel bulletin is long. It stacks Critical remote-code-execution and elevation issues across IMS, VPU, modem, bootloader, Trusted Execution Environment, and other subsystems, plus High-severity items across the stack. CVE-2026-58704 is not the only Critical or High modem entry, and it is not labeled Critical in Google's table. What singles it out is the exploitation note. Most Pixel CVEs ship without that sentence. This one arrives with Google saying the wild already has a limited footprint.

For Pixel owners the action is simple. Install the September security update and confirm the device reports a patch level of September 5, 2026 or later. Google says that level addresses the issues in the Pixel bulletin and those in the September 2026 Android Security Bulletin. Firmware images are also listed on the Google Developer site for devices that take sideloaded updates.

The odd angle is the combination of zero-click adjacent reach and official confirmation of targeted use. Consumer phone flaws usually surface as theoretical High ratings until researchers prove a chain. Here Google is effectively saying someone already did the work against a small set of targets, and the rest of the Pixel fleet should treat the September patch as urgent rather than optional.o remote proximal or adjacent escalation of privilege with no additional execution privileges needed, and with no user interaction required for exploitation. Google classifies the issue as High severity EoP. Secondary reporting puts the CVSS at 8.0 and frames the attack as reachable through the modem's externally facing cellular surface rather than a malicious app the victim has to install.

Google has not named who discovered the flaw, when exploitation began, which Pixel models were hit, or who was targeted. The associated Android bug ID, A-484011314, remains marked private in the bulletin. That thin disclosure is deliberate. The company is telling owners the risk is real enough to patch immediately while withholding the mechanics that would help copycats.