Google confirms Pixel phones exploited by modem vulnerability, patched in September 2026 update

Pixel Phones Targeted by Modem Exploit

Google has confirmed that a "limited" number of Pixel phones were subjected to a targeted attack. The exploitation utilized a vulnerability related to the device's cellular modem, identified as CVE-2026-58704. This issue was addressed as part of the September 2026 security update, which included patches for over 200 security vulnerabilities.

Details of the Vulnerability

CVE-2026-58704 is described as a permission bypass in the cellular modem due to a logic error. This flaw could lead to remote (proximal/adjacent) escalation of privilege without requiring any additional execution privileges or user interaction. CISA noted that this is a "known exploited vulnerability" and a frequent attack vector for malicious cyber actors.

Impact and Resolution

The exact details of how the vulnerability was exploited and which specific Pixel models were affected remain unclear. However, the nature of the exploit, often referred to as a "zero-click" attack, highlights its severity. Pixel users are advised to install the September 2026 patch immediately to secure their devices against this vulnerability.