Google Pixel CVE-2026-58704: Android Zero-Day Exploited

Google Pixel CVE-2026-58704 is an actively exploited Android zero-day (CVSS 8.0, CWE-285) in the cellular modem that lets an attacker with adjacent network access bypass permissions and escalate privileges on a device, with no user interaction required. Google says it is under limited, targeted exploitation and fixed it in the September 2026 Pixel update (2026-09-05 patch level), so install it now.

The vulnerability sits in the modem subcomponent, the baseband that handles cellular connectivity, rather than in an app or in the main Android runtime. According to BleepingComputer and Google's own Pixel security bulletin, a logic error creates a possible permission bypass that an attacker within adjacent network range can use to escalate privilege on the device. Google flagged it as being under limited, targeted exploitation, the language it reserves for a real-world zero-day rather than a theoretical bug.

CVE-2026-58704 is an improper-authorization flaw (CWE-285) carrying a CVSS score of 8.0. What makes it notable is not the number but the reachability: the attack needs adjacent network access and only basic device privileges, requires no clicks from the victim, and runs at low complexity. It shipped alongside a large September batch, Google addressed 110 vulnerabilities in this update, including 12 remote code execution issues and 89 privilege-escalation flaws rated critical or high. The zero-day is the headline, but the volume underneath it is the routine reality of mobile patch cycles.

What is CVE-2026-58704 and which devices does it affect?

CVE-2026-58704 is a permission-bypass vulnerability in the cellular modem of Google Pixel devices. Because the modem is a shared, low-level component, the flaw affects all supported Pixel models rather than a single generation. The practical effect is that an attacker positioned on an adjacent network can bypass an authorization boundary and gain elevated privileges on the phone without tricking the user into anything, which is the property that makes a modem or baseband bug attractive to targeted-surveillance operators.

How do I patch CVE-2026-58704 on a Pixel?

Install the September 2026 security update, which corresponds to the 2026-09-05 patch level. On the device, open Settings, then Security and privacy, then System and updates, then Security update, and apply what is offered. Confirm afterward that the security patch level reads 2026-09-05 or later, because for a modem-level fix, the update has not truly landed until the patch level reflects it.

Is CVE-2026-58704 being actively exploited?

Yes. Google describes limited, targeted exploitation, without naming a threat actor. That framing typically points at narrowly aimed activity rather than mass exploitation, but a no-interaction privilege bypass in the baseband is exactly the capability commercial surveillance vendors buy. For most users the risk is not being individually hunted; it is running an unpatched device for weeks after a fix is available while the technique quietly spreads.

Our read

Baseband bugs are the uncomfortable part of mobile risk because they live below the apps and permissions people can see or reason about, and a fix is only real once the patch level actually advances on the device. The gap that matters is not disclosure to patch availability, which Google closed quickly here, but patch availability to confirmed deployment across a fleet. That is the same continuous-verification discipline we apply everywhere: do not assume the update reached every device, verify the patch level. It is also a reminder that privilege escalation is how most intrusions actually progress, an attacker rarely lands with full control and instead reaches for a bypass like this one to get it. For an organization with Pixels in its estate, "we pushed the September update" and "every device reports the 2026-09-05 patch level" are different statements, and only the second one is evidence.

Reporting by BleepingComputer; CVE, CVSS 8.0, CWE-285, patch level, and exploitation status per Google's Pixel security bulletin. Sources linked above.

Frequently asked questions

What is CVE-2026-58704?
It is an actively exploited Android zero-day in the Google Pixel cellular modem (CVSS 8.0, CWE-285). A logic error creates a permission bypass that lets an attacker with adjacent network access escalate privileges with no user interaction.

Which Pixel devices are affected by CVE-2026-58704?
All supported Google Pixel devices, because the flaw is in the shared modem subcomponent rather than a model-specific app.

How do I fix CVE-2026-58704?
Install the September 2026 Pixel security update (2026-09-05 patch level) via Settings, Security and privacy, System and updates, Security update, then confirm the patch level shows 2026-09-05 or later.

Is CVE-2026-58704 being exploited?
Yes. Google says the flaw is under limited, targeted exploitation, its standard description for a real-world zero-day.