Google confirmed that a high‑severity zero‑day vulnerability in the cellular modem of its Pixel smartphones – tracked as CVE‑2026‑58704 – was under limited, targeted exploitation in the wild. The flaw allows a privilege‑escalation bypass without any user interaction, making it a classic zero‑click attack.
According to the vendor advisory, the issue resides in the modem’s permission checks: "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed." The exploit does not require the victim to click a link or open a file, and can be triggered remotely via the cellular network.
TechCrunch
Google’s September 2026 security update (patch level 2026‑09‑05) addresses the vulnerability along with more than 100 other issues. The company urged all Pixel users to install the update immediately. BleepingComputer reported that the patch also includes fixes for numerous critical flaws across the modem, bootloader, and other components.
Security researchers highlighted that the zero‑day was likely exploited by a sophisticated actor, possibly a commercial spyware vendor or a state‑sponsored group, given the targeted nature of the attacks. SecurityWeek noted that the exploitation was limited but confirmed, prompting the US CISA to add the CVE to its Known Exploited Vulnerabilities catalog and give federal agencies a short remediation window.
While Google did not disclose the number of affected devices or the exact attack chain, the public advisory emphasizes the urgency of applying the patch to mitigate further risk.
Top comments (0)