Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

Google Patches Pixel Zero Day Exploited in Targeted Attacks

Part of the CVE-2026-58704 story · since 16 Sep

Quiet for 3 weekslast report 9 Oct8 articles6 outlets
16 Sep · SecurityOnline first10 Oct18 OctNowThis article3rd of 8
  • Wed 16 Sep, 07:57 UTC. SecurityOnline, first report. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 11:22 UTC. Malwarebytes, its first report on the story. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 13:40 UTC. SecurityWeek, its first report on the story. Google Patches Pixel Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV. This article, 3rd of 8.
  • Wed 16 Sep, 14:01 UTC. CISA, its first report on the story. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:16 UTC. Security Affairs, its first report on the story. Google Fixes Exploited Pixel Modem Flaw in September Update. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 16:01 UTC. CISA. CISA Warns of Active Exploitation in Google Pixel Vulnerability. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 10:20 UTC. The Hacker News, its first report on the story. Hackers Earn $562,500 for Three Remote Exploits on Pixel 10. Cites a CVE in CISA KEV.

Google has patched a high-severity zero-day in the modem component of Pixel smartphones after observing “limited, targeted exploitation”. Tracked as CVE-2026-58704, the vulnerability results from a logic error that can allow a permission bypass and remote escalation of privilege from an adjacent or nearby position. Exploitation requires no additional execution privileges or user interaction, making it a zero-click flaw. Google has not identified the threat actor or attackers responsible.

The latest Pixel updates also include the September 2026 Android security patches and fixes for more than 100 additional Pixel-specific vulnerabilities. Nearly 50 are rated critical and affect components including the multimedia subsystem, VPU, modem, telephone, bootloader, TEE, libpixelimsmedia, GDMC, GSA and GPCA. These issues can enable remote code execution or privilege escalation, while other high-severity flaws may allow information disclosure or denial of service. Pixel owners should install the latest available device update.

How the story developed

All 8 articles
Quiet for 3 weekslast report 9 Oct8 articles6 outlets

8 articles from 6 outlets since 16 Sep. Quiet since 9 Oct. This was the 3rd report, 6 hours after the first.

Now16 Sep179 OctFirst reportSecurityOnline · 16 Sep, 07:57This article3rd of 8 · day 0
  • Wed 16 Sep, 07:57 UTC. SecurityOnline, first report. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 11:22 UTC. Malwarebytes, its first report on the story. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 13:40 UTC. SecurityWeek, its first report on the story. Google Patches Pixel Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV. This article, 3rd of 8.
  • Wed 16 Sep, 14:01 UTC. CISA, its first report on the story. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:16 UTC. Security Affairs, its first report on the story. Google Fixes Exploited Pixel Modem Flaw in September Update. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 16:01 UTC. CISA. CISA Warns of Active Exploitation in Google Pixel Vulnerability. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 10:20 UTC. The Hacker News, its first report on the story. Hackers Earn $562,500 for Three Remote Exploits on Pixel 10. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Wed 16 SepDay 06
    1. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks07:57 · SecurityOnline · First report · Known exploited CVE
    2. Google Patches Pixel Zero Day Exploited in Targeted Attacks13:40 · SecurityWeek · Known exploited CVE · This article, 3rd of 8
    3. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks14:01 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 16 Sep
    1. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks11:22 · Malwarebytes · Known exploited CVE
    2. Google Fixes Exploited Pixel Modem Flaw in September Update14:16 · Security Affairs · Known exploited CVE
    3. CISA Warns of Active Exploitation in Google Pixel Vulnerability16:01 · CISA · official · Known exploited CVE
  2. Thu 17 SepDay 11
    1. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws10:42 · Security Affairs · Known exploited CVE

  3. Quiet for 3 weeks

    Fri 9 OctDay 231
    1. Hackers Earn $562,500 for Three Remote Exploits on Pixel 1010:20 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in