Google's September 2026 Pixel security release fixes 110 vulnerabilities, including CVE-2026-58704, a high-severity Cellular Modem flaw that Google reports has seen limited, targeted exploitation in the wild. The weakness permits privilege escalation from an adjacent network without user interaction. Supported Pixel devices are moving to the 2026-09-05 patch level, which users should install immediately.
Affected devices and bulletin scope
The September 2026 Pixel bulletin covers 110 issues in total. Beyond the exploited modem defect, Google lists 109 additional flaws, among them 12 remote code execution issues and 89 privilege escalation issues rated critical or high severity.
Pixel phones run Android but are serviced separately from the monthly patches sent to other Android OEMs. That split reflects Google's direct control of the Pixel hardware platform and its Pixel-only features and capabilities. Details are in the September 2026 Pixel security bulletin and the NVD entry for CVE-2026-58704.
How the attack works
CVE-2026-58704 affects the Modem subcomponent and is described as high severity. The root cause involves improper authorization combined with protection mechanism failure, traced to a logic error in code that enforces permission checks.
According to the advisory characterization, the Cellular Modem code can incorrectly grant access when it should deny it. That permission bypass opens remote escalation of privilege in proximal or adjacent scenarios without demanding extra execution privileges.
Successful use requires two preconditions: reach over an adjacent network and basic privileges on the target handset. The operation is rated low complexity and needs no victim interaction. In practical terms, a nearby-capable attacker with a low-privileged foothold could gain higher privileges through the modem path.
CISA has added the issue to its Known Exploited Vulnerabilities catalog as a Google Pixel Improper Authorization Vulnerability, noting evidence of active exploitation and describing it as a logic error that lets an attacker bypass permission checks and escalate privileges, with associated weakness CWE-693. See the CISA alert adding CVE-2026-58704 and the CISA KEV catalog entry. No shell commands, exploit code, packet captures, hashes, IPs, domains, or file paths for this incident were included in the supplied source material; an Exploit-DB search for CVE-2026-58704 is available for tracking any future public artifacts.
Detection and mitigation
Google states that every supported Google device will get an update to patch level 2026-09-05 and urges customers to accept the device updates. No indicators of compromise were provided in the source to hunt for.
To install on a Pixel handset, follow this path:
Settings > Security & privacy > System & updates > Security update
Then tap Install and restart the handset to finish the process. Administrators should verify fleet patch levels reflect 2026-09-05 after rollout and prioritize devices that may handle sensitive communications because of the modem attack surface.
Technical background — general explanation, not specific to this incident
This section provides general context on this vulnerability class only. It does not describe the non-public exploit steps for CVE-2026-58704.
Improper authorization means code fails to confirm that a caller is allowed to perform a modem operation. Protection mechanism failure, CWE-693, means a safeguard that should enforce that decision can be bypassed because of flawed logic. In cellular baseband stacks, such checks often gate commands exchanged between the application processor and modem firmware.
A proximal or adjacent attacker is one who does not need physical access but does need a network position close to the victim, such as the same radio or local link, rather than arbitrary Internet reach. When combined with a low-privilege local foothold, that position can be enough to invoke a privileged modem function.
The following is a generic illustration only, not incident-specific:
# Generic illustration: check Android security patch level on a test device
adb shell getprop ro.build.version.security_patch
Defenders generally reduce exposure to this class by applying modem and platform patches promptly, minimizing unnecessary local access, inventorying patch levels centrally, and monitoring for unexpected privilege transitions or modem crashes.
Earlier zero-day and bounty context
In June, Google fixed a separate Android Framework zero-day, CVE-2025-48595, also reported as actively exploited in targeted attacks. That flaw could enable code execution and privilege escalation on devices running Android 14 or later.
One month earlier, Google revised its Android and Chrome vulnerability rewards programs, reducing payouts for bug types more readily discovered with artificial intelligence (AI) while retaining bounties of up to $1.5 million for selected Android exploits.