Google Fixes Exploited Pixel Modem Flaw in September Update

Google’s September 2026 Pixel security update fixes CVE-2026-58704, a high-severity cellular modem vulnerability with a CVSS score of 8.0. The flaw is a permission bypass caused by a logic error, potentially allowing remote, proximal or adjacent privilege escalation without user interaction or additional execution privileges. Google said there are indications that it was used in “limited, targeted exploitation”, but did not identify the attackers, affected devices, targets or objectives.

The issue affects the modem, a security-sensitive component handling communications between Pixel devices and mobile networks. Its adjacent attack classification means it is not broadly exposed to the internet, although exploitation of the modem could provide a route to higher privileges outside the normal Android application security model. Google has not published details of a complete attack chain and has not attributed the activity to a commercial spyware provider or state-sponsored group.

The bulletin also addresses vulnerabilities in other Pixel and Android components, including the kernel, bootloader, telephony stack, Trusted Execution Environment, GPU, Bluetooth and NFC. Google says supported devices with the 2026-09-05 security patch level or later are protected, making prompt installation important for Pixel users and organisations managing Pixel fleets.