Google Patches Actively Exploited Zero-Day in Pixel Smartphones
Google has confirmed active exploitation of a high-severity Android zero-day vulnerability (CVE-2026-58704) affecting Pixel smartphones, prompting an emergency patch in the September 2026 Pixel Update Bulletin. The flaw, an elevation-of-privilege (EoP) weakness in the device’s cellular modem, allows attackers within radio proximity to bypass permissions and escalate privileges without user interaction.
The exploit is low-complexity and requires no victim engagement, making it particularly dangerous. Google describes the attacks as "limited, targeted," suggesting use by sophisticated actors likely commercial spyware vendors or state-aligned surveillance groups against high-value targets. The vulnerability resides in the modem’s authorization logic, enabling adjacent attackers with basic device access to gain deeper control.
The September 2026 Pixel bulletin, released on September 15, addresses 110 vulnerabilities, including 12 remote code execution (RCE) and 89 privilege-escalation flaws rated critical or high. Among them are critical RCE bugs in components like the IP Multimedia Subsystem, libpixelimsmedia, and the Modem, alongside fixes for bootloader, Trusted Execution Environment, and Titan security modules.
Pixel devices receive dedicated patches separate from the broader Android ecosystem, which saw 180 vulnerabilities patched this month, including a critical Wi-Fi memory-corruption flaw (CVE-2026-28662). Google issued two patch levels 2026-09-01 and 2026-09-05 with the latter fully remediating CVE-2026-58704 and all other September fixes. Supported devices, including Pixel 6 through Pixel 11 series, Pixel Tablet, and Fold models, are receiving the update, though Pixel 6 and 6 Pro will reach end-of-life in October 2026.
Users are advised to install the update via Settings > Security & privacy > System & updates > Security update or manually via Google’s Developer site. Given confirmed exploitation, patching is considered urgent, particularly for individuals at higher risk of targeted attacks.
Source: https://cybersecuritynews.com/android-pixel-zero-day/
Google TPRM report: https://www.rankiteo.com/company/google
"id": "goo1789554285",
"linkid": "google",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Pixel 6 through Pixel 11 '
'series, Pixel Tablet, and Fold '
'models',
'industry': 'Consumer Electronics',
'location': 'Global',
'name': 'Google Pixel',
'size': 'Large (Google LLC)',
'type': 'Technology (Smartphones)'}],
'attack_vector': 'Adjacent Network (Radio Proximity)',
'customer_advisories': 'Users are advised to install the update immediately '
'to mitigate the risk of exploitation.',
'date_publicly_disclosed': '2026-09-15',
'date_resolved': '2026-09-15',
'description': 'Google has confirmed active exploitation of a high-severity '
'Android zero-day vulnerability (CVE-2026-58704) affecting '
'Pixel smartphones. The flaw, an elevation-of-privilege (EoP) '
'weakness in the device’s cellular modem, allows attackers '
'within radio proximity to bypass permissions and escalate '
'privileges without user interaction. The exploit is '
'low-complexity and requires no victim engagement, making it '
'particularly dangerous. The vulnerability resides in the '
'modem’s authorization logic, enabling adjacent attackers with '
'basic device access to gain deeper control.',
'impact': {'brand_reputation_impact': 'Moderate (confirmed exploitation of a '
'zero-day)',
'operational_impact': 'Privilege escalation, potential '
'unauthorized access to device functions',
'systems_affected': 'Pixel smartphones (modem, bootloader, Trusted '
'Execution Environment, Titan security '
'modules)'},
'initial_access_broker': {'high_value_targets': 'Yes (likely high-value '
'individuals)'},
'investigation_status': 'Resolved (patch released)',
'lessons_learned': 'Zero-day vulnerabilities in cellular modems can be '
'exploited with low complexity and no user interaction, '
'posing significant risks to high-value targets. Timely '
'patching is critical for devices at risk of targeted '
'attacks.',
'motivation': ['Targeted surveillance', 'Espionage'],
'post_incident_analysis': {'corrective_actions': 'Patch released to fix '
'CVE-2026-58704 and other '
'critical vulnerabilities in '
'the modem, bootloader, and '
'security modules.',
'root_causes': 'Vulnerability in the cellular '
'modem’s authorization logic '
'allowing adjacent attackers to '
'escalate privileges without user '
'interaction.'},
'recommendations': ['Install the September 2026 Pixel Update immediately via '
'*Settings > Security & privacy > System & updates > '
'Security update* or manually via Google’s Developer '
'site.',
'Prioritize patching for individuals at higher risk of '
'targeted attacks (e.g., journalists, activists, '
'executives).',
'Monitor for further updates from Google regarding '
'additional mitigations or advisories.'],
'references': [{'date_accessed': '2026-09-15',
'source': 'Google Pixel Update Bulletin (September 2026)'}],
'response': {'communication_strategy': 'Public disclosure via Pixel Update '
'Bulletin and advisories',
'containment_measures': 'Emergency patch deployment (September '
'2026 Pixel Update Bulletin)',
'incident_response_plan_activated': 'Yes (Emergency patch '
'released)',
'recovery_measures': 'Manual update via Settings or Google’s '
'Developer site',
'remediation_measures': 'Fixed CVE-2026-58704 and 109 other '
'vulnerabilities (12 RCE, 89 '
'privilege-escalation flaws)'},
'stakeholder_advisories': 'Urgent patching recommended for all supported '
'Pixel devices, especially for high-risk '
'individuals.',
'threat_actor': ['Sophisticated actors',
'Commercial spyware vendors',
'State-aligned surveillance groups'],
'title': 'Google Patches Actively Exploited Zero-Day in Pixel Smartphones '
'(CVE-2026-58704)',
'type': 'Zero-Day Exploitation',
'vulnerability_exploited': 'CVE-2026-58704 (Elevation-of-Privilege in '
'Cellular Modem)'}