Google Patches Actively Exploited Pixel Modem Zero-Day CVE-2026-58704

What happened

Google's September 2026 Pixel security bulletin discloses a high-severity flaw in the cellular modem of its Pixel phones that the company says shows signs of having already been used against real targets before a fix existed 369. The bug, tracked as CVE-2026-58704, is described by Google as an elevation-of-privilege issue rooted in a logic error that lets an attacker bypass permission checks in the modem subsystem 91012. Crucially, exploitation requires no tap, click, or app install from the victim — the defining trait of what's commonly called a zero-click attack 91014.

Google's own language is notably restrained. The company says only that there are "indications" the flaw "may be under limited, targeted exploitation," stopping well short of confirming a campaign, naming a threat actor, or describing how many devices were affected 3101920. That phrasing has been picked up nearly verbatim across the coverage, from SecurityWeek to Security Affairs to The Hacker News, underscoring how little independently verified detail exists beyond what Google chose to publish 1920.

The flaw sits in the modem, or baseband — the component that handles a phone's connection to cellular networks, operating beneath the visible Android operating system and largely outside the reach of ordinary app-level defenses 1317. Google has separately acknowledged the modem as an area of rising attacker interest, noting its own Project Zero team achieved remote code execution against Pixel modems in past research, and detailing an ongoing effort to rewrite risky modem firmware components in the memory-safe language Rust starting with the Pixel 10 17.

The scale of the September update

CVE-2026-58704 is one of 110 vulnerabilities addressed in the September Pixel Update Bulletin 913. Coverage breaks down the remaining 109 issues in slightly different ways: The Hacker News and infosectoday.io report 88 privilege-escalation flaws, 10 information-disclosure bugs, nine remote-code-execution issues, and two denial-of-service flaws, alongside 46 critical-severity vulnerabilities in components such as BigOcean, the bootloader, the IP Multimedia Subsystem, and the Trusted Execution Environment 1015. BleepingComputer instead frames the bulletin as containing 12 remote-code-execution and 89 privilege-escalation bugs rated critical or high 9. These are different slicing methods rather than necessarily contradictory tallies, but readers should note the counts don't map onto each other cleanly.

CyberInsider adds specificity by naming several of the other critical bugs patched alongside the modem zero-day, including remote-code-execution flaws in the IP Multimedia Subsystem, the VPU, and the modem itself, plus a cluster of critical elevation-of-privilege issues in the bootloader, Trusted Execution Environment, KeyMint, and fingerprint components 12. All fixes land at the 2026-09-05 security patch level, which Pixel owners can check under Settings > Security & privacy > System & updates > Security update 91213.

Government response raises the stakes

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog on September 16, giving federal civilian agencies until September 19 — just three days — to patch 14. CISA's own language, that this class of vulnerability "poses significant risks to the federal enterprise," is a sharper statement than anything Google itself has said publicly, and it's this KEV listing, more than any CVSS number, that signals confirmed rather than merely suspected exploitation 14.

On scoring, the record is genuinely inconsistent: The Hacker News reports a CVSS score of 8.0, while OpenCVE's vulnerability enrichment lists an updated score of 8.8 with an adjacent-network, low-complexity, no-privileges-required, no-user-interaction vector 1016. That shift appears to reflect a revision in the scoring rather than two outlets disagreeing about the same fixed number, but it means anyone citing a single score should note which version they're using.

Where the reporting agrees

Across android headlines, TechCrunch, SecurityWeek, BleepingComputer, The Hacker News, CyberInsider, Malwarebytes, The Register, Security Affairs, and CISA's own catalog entry, the core facts are consistent: CVE-2026-58704 is a high-severity, zero-click, permission-bypass flaw in the Pixel cellular modem, disclosed and patched in the September 15 Pixel Update Bulletin, with Google acknowledging signs of limited, targeted real-world exploitation 1369101213141920. Every outlet agrees Google has not named a suspected attacker, disclosed victim counts, or explained the technical exploit chain 121920. There is also uniform agreement that the fix requires updating to the 2026-09-05 patch level, and that the bulletin patches well over a hundred issues total, not just the one zero-day 91013. That level of convergence, on both the technical description and on what Google has deliberately withheld, suggests the outlets are working from the same limited primary source — Google's advisory and the NVD record — rather than from independent reporting that has turned up new facts.

Where it doesn't

The clearest divergence is in framing rather than fact. The Register's headline, "Google Pixel phones pwned in zero-click attacks," foregrounds the real-world compromise and pairs it with CISA's three-day federal patch deadline, producing an urgent, almost alarmed tone 14. By contrast, Malwarebytes and lapaasvoice.com push back explicitly against reading too much into the disclosure, cautioning that Google's "limited, targeted" wording is far narrower than a claim of mass exploitation, and that an adjacent-network attack vector does not mean every unpatched Pixel is reachable from anywhere on the internet 1318. SecurityWeek's Eduard Kovacs occupies a middle position, noting that the zero-click, modem-level characteristics resemble past attacks linked to commercial spyware vendors or state-sponsored actors, while being careful to flag that Google has made no such attribution itself 20.

The numerical breakdowns of the 109 non-headline vulnerabilities also don't line up cleanly between BleepingComputer's 12-RCE/89-privilege-escalation framing and The Hacker News's 88/10/9/2 split 910. Neither outlet flags the discrepancy, and it likely stems from different categorization choices in the underlying bulletin rather than a factual error by either. Similarly, the CVSS score cited varies between 8.0 and 8.8 depending on when a given outlet pulled the record 1016, and only OpenCVE's enrichment data surfaces the later, higher figure with the adjacent-network vector spelled out in full.

What the evidence supports

Taken together, the reporting supports a narrower conclusion than the most dramatic headlines imply, but a more urgent one than the most cautious. Google's own advisory language — "may be under limited, targeted exploitation" — is the operative fact, and it has not been contradicted or expanded upon by any outlet with independent access to victims, telemetry, or the exploit chain itself. That means the responsible reading is that a small number of Pixel devices were likely compromised through a genuine zero-click modem vulnerability, consistent with the kind of narrowly deployed spyware or nation-state tooling Google has documented in other zero-day disclosures, including June's actively exploited Android Framework bug CVE-2025-48595 167. But nothing in the record — not Google's bulletin, not CISA's KEV entry, not any of the outlets covering it — establishes mass exploitation, full remote code execution from the modem bug alone, or the identity of whoever built the attack. The urgency is real and confirmed by CISA's independent action; the scale is not, and readers should treat any claim to the contrary as unsupported by what's actually been published.