Google has patched a critical security vulnerability affecting its Pixel devices, one that was being actively exploited in targeted attacks. The zero-day flaw, identified as CVE-2026-58704, stems from weaknesses in the Modem subcomponent, allowing attackers to escalate privileges with minimal complexity and no user interaction required.
The vulnerability is particularly concerning because it can be exploited by individuals with access to an adjacent network and basic privileges on the targeted device. Google warned that there are indications of limited, targeted exploitation, but did not provide further details. The September 2026 security patches address a total of 110 vulnerabilities affecting Pixel devices, including this high-severity flaw.
The CVE-2026-58704 vulnerability affects the Cellular Modem, where a logic error in the code allows for permission bypass and remote privilege escalation. This could enable attackers to gain unauthorized access to sensitive areas of the device without needing additional execution privileges. Google’s security advisory notes that successful exploitation could lead to “remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed.”
The September 2026 patches also address numerous other critical and high-severity vulnerabilities, including 12 remote code execution and 89 privilege escalation issues. These vulnerabilities are rated as critical or high severity, underscoring the importance of applying this month’s security updates to Pixel devices.
It is worth noting that Google Pixel devices receive separate security updates from the standard monthly patches distributed to Android OEMs due to their unique hardware platform and exclusive features. Users must follow a specific process to apply the September 2026 security updates: navigate to Settings > Security & privacy > System & updates > Security update, tap Install, and restart their device.
This latest vulnerability is not an isolated incident; in June, Google addressed another Android Framework zero-day flaw (CVE-2025-48595) that was actively exploited in targeted attacks. The company has also revamped its vulnerability rewards programs, offering bounties of up to $1.5 million for some Android exploits while scaling back payouts for flaws that are easier to find using artificial intelligence.
For Pixel users, the takeaway is clear: applying this month’s security updates is essential to protect against potential exploitation attempts. By following the recommended update process and ensuring their devices are running the latest patches, users can minimize the risk of falling victim to targeted attacks.
Source: Bleeping Computer — 2026-09-16