Google Fixes Pixel Modem Flaw With Signs of Targeted Exploitation
Google’s September update for supported Pixel devices addresses the CVE-2026-58704 vulnerability in the mobile modem. Google says there are signs of limited, targeted exploitation.
The Pixel modem patch is part of the September security update that Google published on September 15, 2026, for supported Pixel devices. The update fixes the CVE-2026-58704 vulnerability in a mobile modem subcomponent. Google says there are signs of limited, targeted exploitation.
The flaw is rated High and classified as a privilege escalation issue. According to the CVE record, it may allow proximate, or adjacent, privilege escalation without user interaction. However, public materials do not describe the technical attack method or the conditions under which it could be exploited.
The Pixel modem patch requires the 2026-09-05 level
In the Pixel Update Bulletin, Google says all issues included in the September bulletin are addressed by security patch level 2026-09-05 or later. Users of supported Pixel devices can therefore check the security update date in the system settings and install the available update.
The rollout is gradual. Google warns that update availability may vary by device and carrier. This means the same version may not be available to all users at the same time.
Google has not confirmed the scope of the attacks
Google’s wording refers only to signs of limited, targeted exploitation. The company has not disclosed the scope of the cases, the identity of possible attackers, information about victims, or the method of exploitation. It is therefore not confirmed that this is a widespread or broadly active exploited flaw.
In the available materials, Google does not mention a separate temporary risk mitigation. The known solution is to install the September update with the September 5, 2026 patch or later.
What to watch next
- availability of the 2026-09-05 update for individual supported Pixel models and carriers,
- any technical details, indicators of compromise, or campaign data from Google,
- confirmed exploitation cases and information about whether the fix will also appear outside Pixel devices.
Sources
- Google / Android Open Source Project — Pixel Update Bulletin—September 2026 – Confirms the bulletin’s release on September 15, the CVE-2026-58704 fix, its High/EoP classification in the modem, signs of limited, targeted exploitation, and the fix through patch level 2026-09-05.
- Google Pixel Community — Google Pixel Update – September 2026 – Confirms the start of the gradual September update rollout for supported Pixel devices and possible dependence on the device and carrier.
- BleepingComputer — Google fixes actively exploited Android zero-day on Pixel devices – Independently summarizes the update’s release and notes that Google’s wording refers to limited, targeted exploitation.
Verified and updated: 09/16/2026 15:21
