Google has rolled out a critical security update to fix a zero-day vulnerability in its Pixel devices, which was being actively exploited in targeted attacks. The flaw, identified as CVE-2026-58704, affects the Cellular Modem subcomponent and allows attackers with basic privileges on the device to escalate their access to the system without needing user interaction.
The vulnerability stems from improper authorization and protection mechanism failure, which enable an attacker to bypass permissions and gain elevated access to the device. This can be done remotely, using an adjacent network connection, making it a significant threat to users who have not applied the latest security patches. Google has confirmed that 110 vulnerabilities were addressed in this month’s update, including 12 remote code execution and 89 privilege escalation flaws.
The affected devices are part of Google’s Pixel range, which operates on a separate security update cycle from standard Android devices. This is due to the unique hardware platform controlled by Google, which requires distinct updates and bug fixes to ensure device stability and security. The September 2026 security patches will be rolled out to all supported Pixel devices, with users encouraged to apply the latest update as soon as possible.
The exploitation of this zero-day flaw highlights the ongoing threat posed by targeted attacks on Android devices. In recent months, several high-profile vulnerabilities have been discovered in Google’s Android framework and operating system, including a similar zero-day exploit addressed in June (CVE-2025-48595). The company has also revamped its vulnerability rewards program to incentivize researchers to identify and report flaws, offering bounties of up to $1.5 million for some Android exploits.
To protect their devices from this and other potential threats, Pixel users must ensure they have applied the latest security updates. This can be done by navigating to Settings > Security & privacy > System & updates > Security update, tapping Install, and restarting the device once the process is complete. It’s essential to stay vigilant about software updates, as they often contain critical patches that prevent exploitation of vulnerabilities like CVE-2026-58704.
In summary, Google has released a crucial security patch for its Pixel devices to address an actively exploited zero-day vulnerability. The update fixes 110 flaws, including 12 remote code execution and 89 privilege escalation issues. To protect their devices from potential threats, users should apply the latest updates as soon as possible and stay informed about software patches and security best practices.
Source: Bleeping Computer — 2026-09-16