Google has confirmed that a high-severity Android zero-day flaw affecting its Pixel smartphones is being actively exploited in the wild, and it has shipped emergency patches as part of the September 2026 Pixel Update Bulletin.
Tracked as CVE-2026-58704, the vulnerability resides in the device Modem subcomponent and is being weaponized in what the company describes as “limited, targeted” attacks. Users are urged to move to the 2026-09-05 security patch level without delay.
Android Pixel 0-Day Exploited
The bug is an elevation-of-privilege (EoP) weakness rooted in improper authorization and a protection-mechanism failure within the cellular modem.
According to the advisory, “In Cellular Modem, there is a possible permission bypass due to a logic error in the code,” which “could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed”.
In plain terms, an attacker positioned on an adjacent network, someone within radio proximity of the target who already holds basic privileges on the device, can quietly elevate their access.
What makes CVE-2026-58704 particularly concerning is how little the attack demands. Google notes the exploit is low-complexity and requires no user interaction, meaning a victim does not need to tap a link, install an app, or make any mistake for the intrusion to succeed.
Flaws in the modem layer are especially prized by sophisticated actors because they sit close to the baseband and can serve as a stealthy stepping stone toward deeper device compromise.
The “limited, targeted” language Google uses is the same phrasing it has historically applied to zero-days leveraged by commercial spyware vendors and state-aligned surveillance operators, suggesting a narrow but high-value victim set rather than mass exploitation.
CVE-2026-58704 did not arrive alone. According to the official advisory released by Google, the September 2026 Pixel bulletin, published on September 15, patches a total of 110 vulnerabilities on Pixel hardware, including 12 remote code execution and 89 privilege-escalation issues rated critical or high.
Several critical-severity RCE flaws affect components such as the IP Multimedia Subsystem, libpixelimsmedia, the VPU, the Modem, and the BigOcean media engine, while a long list of bootloader, Trusted Execution Environment, and Titan-security-related components received critical EoP fixes.
Because Pixel devices run Google-controlled hardware, they receive a dedicated bulletin separate from the broader Android Security Bulletin distributed to other OEMs.
The Pixel patches build on the wider September 2026 Android update, which SecurityWeek reported addressed roughly 180 vulnerabilities across the ecosystem, including dozens of critical flaws such as the Wi-Fi memory-corruption bug CVE-2026-28662.
Google issued two patch strings this month, 2026-09-01 and 2026-09-05, with the latter level closing out every applicable September fix plus prior outstanding issues.
Any security patch level of 2026-09-05 or later fully remediates CVE-2026-58704 and every other issue in the bulletin, and all supported Google devices are receiving the update. That supported roster spans the Pixel 6 series through the newly launched Pixel 11 family, along with the Pixel Tablet and Fold models.
Owners of the aging Pixel 6 and 6 Pro should note that those handsets reach end-of-life in October 2026, making this one of their final guaranteed security refreshes.
To install the update, Pixel users should open Settings, navigate to Security & privacy, then System & updates, tap Security update, select Install, and restart the device to complete the process.
Firmware images are also available on the Google Developer site for advanced users who prefer manual flashing.
Given confirmed exploitation, applying this patch should be treated as urgent rather than routine, especially for journalists, executives, activists, and other individuals who fall within the typical targeting profile of proximal, zero-click modem exploits.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks appeared first on Cyber Security News.