Google warns a Pixel modem flaw lets an attacker in with no tap from the owner

Google’s September 2026 Pixel security bulletin carries an entry that most owners will never notice: CVE-2026-58704, a flaw in the phone’s cellular modem that needs no tap, no link and no opened file to be triggered. Google said the bug “may be under limited, targeted exploitation,” which in bulletin language means someone was already using it against chosen victims.

The fix ships with the patch level dated 2026-09-05, and the federal government treated it as urgent enough to give federal agencies three days to apply it.

Google’s bulletin entry for the Pixel modem

The Register, which first covered the disclosure on 16 September, reported the entry as a high-severity improper authorization bug in Pixel cellular modems that allows privilege escalation without user interaction. Google declined to say who was being targeted, by whom, or how many devices were hit.

The Hacker News, citing the National Vulnerability Database, quoted the record as describing “a possible permission bypass due to a logic error in the code” that permits “remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed,” and gave it a CVSS score of 8.0. The September update fixed 110 flaws in total, 46 of them rated critical, so this one entry sits inside a large batch.

Android Authority, which spotted the entry in the update notes, pointed out the gap in what Google disclosed: “It’s unclear which Pixel devices were affected by the vulnerability or how extensive the targeting was.” No researcher is credited by any outlet that covered the bulletin.

Android Authority explained why the zero-click label carries weight: this type of attack requires no user interaction, so the owner does not need to click anything or open a malicious file for the exploit to work. That is the property the zero-click label rests on, and it is separate from the question of how an attacker gets within radio range in the first place.

Adjacent access and why the modem matters

The wording “proximal/adjacent” deserves attention, because it narrows the picture a bare “zero-click” label can paint. An attacker is described as reaching the phone over the radio link without the owner doing anything, not as being able to take over any Pixel anywhere on the internet from an arbitrary distance. Lookout’s threat-intelligence team, in its write-up of the CVE, says the logic error sits in the cellular modem driver and lets an attacker bypass standard permission checks and escalate privileges at the baseband layer.

That placement is what makes the class valuable. The modem is a separate processor that handles radio communications beneath the Android application layer, and Tech Times quotes Google’s description of such flaws as sitting in “a layer that most conventional security tools cannot see.” A bug there does not depend on the owner installing a bad app or visiting a bad page, which is why spyware sellers prize it.

Tech Times, in its report on the patch, ties the profile to commercial surveillance vendors, noting that Google’s Threat Intelligence Group counted such vendors as responsible for 34.9 percent of attributable zero-day exploitation in 2025, ahead of traditional state-sponsored groups for the first time. The report stops short of naming a vendor for this flaw, and nothing published attributes the attacks to a specific group.

The federal deadline and the patch level

The Cybersecurity and Infrastructure Security Agency added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to patch by 19 September 2026. The agency’s stated reason, as relayed by The Register, was that “this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” TechRepublic’s account of the listing calls the remediation window a mandatory three days, far shorter than the multi-week windows agencies usually receive.

For an individual owner the check is brief. A Pixel on a supported release should show a security patch level of 2026-09-05 or later under Settings, Security and privacy, then System and updates. Phones that no longer receive updates cannot take the fix, and Tech Times notes that such models remain exposed with no remediation available.

Enterprise device managers have a concrete instruction from Lookout, which advises organizations to set the compliance threshold for Google Pixel devices at Android security patch level 2026-09-05 or later. Lookout dates Google’s patch release to 15 September and the CISA listing to the following day, while other outlets give slightly different dates for the catalog entry, so the 19 September deadline is the only date in the federal record that every account shares.

Google has not said how many Pixel owners were reached before the patch, which models the targeted attacks involved, or whether the exploit chain needed any other bug to succeed. The bulletin’s phrase “limited, targeted” is the only measure of scale that has been published.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview