Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Google Patches Pixel Modem Flaw Exploited in Targeted Attacks

Part of the CVE-2026-58704 story · since 16 Sep

Quiet for 3 weekslast report 9 Oct8 articles6 outlets
16 Sep · SecurityOnline first10 Oct18 OctNowThis article1st of 8
  • Wed 16 Sep, 07:57 UTC. SecurityOnline, first report. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV. This article, 1st of 8.
  • Wed 16 Sep, 11:22 UTC. Malwarebytes, its first report on the story. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 13:40 UTC. SecurityWeek, its first report on the story. Google Patches Pixel Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:01 UTC. CISA, its first report on the story. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:16 UTC. Security Affairs, its first report on the story. Google Fixes Exploited Pixel Modem Flaw in September Update. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 16:01 UTC. CISA. CISA Warns of Active Exploitation in Google Pixel Vulnerability. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 10:20 UTC. The Hacker News, its first report on the story. Hackers Earn $562,500 for Three Remote Exploits on Pixel 10. Cites a CVE in CISA KEV.

Google’s 16 September 2026 Pixel Update Bulletin addresses three Android vulnerabilities, including CVE-2026-58704, which Google says may be undergoing limited, targeted exploitation. The flaw affects the cellular modem firmware and is rated 8.0 under CVSSv3. It is described as a permission-bypass issue caused by a logic error in the code, potentially allowing remote privilege escalation without prior access or user interaction.

According to the report, exploitation requires an attacker to be on an adjacent or nearby cellular network. Google has confirmed exploitation in the wild, but no public proof-of-concept code has been released. The bulletin also covers CVE-2026-55318, rated 8.8, and CVE-2026-56967, rated 8.0; both are listed as not exploited. The article says supported Pixel smartphones running firmware released before September 2026 are affected.

Pixel owners should install the update with security patch level 2026-09-05 or later. Updates can be checked manually under Settings > System > System update.

How the story developed

All 8 articles
Quiet for 3 weekslast report 9 Oct8 articles6 outlets

8 articles from 6 outlets since 16 Sep. Quiet since 9 Oct. This was the first report.

Now16 Sep179 OctFirst reportSecurityOnline · 16 Sep, 07:57CISA alert16 Sep, 14:01 · officialPicked up againafter 3 weeks quiet
  • Wed 16 Sep, 07:57 UTC. SecurityOnline, first report. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV. This article, 1st of 8.
  • Wed 16 Sep, 11:22 UTC. Malwarebytes, its first report on the story. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 13:40 UTC. SecurityWeek, its first report on the story. Google Patches Pixel Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:01 UTC. CISA, its first report on the story. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:16 UTC. Security Affairs, its first report on the story. Google Fixes Exploited Pixel Modem Flaw in September Update. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 16:01 UTC. CISA. CISA Warns of Active Exploitation in Google Pixel Vulnerability. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 10:20 UTC. The Hacker News, its first report on the story. Hackers Earn $562,500 for Three Remote Exploits on Pixel 10. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Wed 16 SepDay 06
    1. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks07:57 · SecurityOnline · First report · Known exploited CVE · This article, 1st of 8
    2. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks11:22 · Malwarebytes · Known exploited CVE
    3. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks14:01 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 16 Sep
    1. Google Patches Pixel Zero Day Exploited in Targeted Attacks13:40 · SecurityWeek · Known exploited CVE
    2. Google Fixes Exploited Pixel Modem Flaw in September Update14:16 · Security Affairs · Known exploited CVE
    3. CISA Warns of Active Exploitation in Google Pixel Vulnerability16:01 · CISA · official · Known exploited CVE
  2. Thu 17 SepDay 11
    1. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws10:42 · Security Affairs · Known exploited CVE

  3. Quiet for 3 weeks

    Fri 9 OctDay 231
    1. Hackers Earn $562,500 for Three Remote Exploits on Pixel 1010:20 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in