Google has recently addressed a significant security issue affecting its Pixel Cellular Modem, which had been exploited in the wild. The security vulnerability, identified as CVE-2026-58704 with a CVSS score of 8.0, involves privilege escalation due to a logic error in the modem’s code.
Vulnerability Details and Exploitation
The flaw allows remote escalation of privilege without requiring additional execution privileges or user interaction, enabling potential attackers to bypass permissions. According to the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), this vulnerability could be exploited by attackers in proximity or adjacent to the target device.
Google reported on Tuesday that there are signs of limited, targeted exploitation of CVE-2026-58704. However, the company has not released detailed information regarding the attacks or the threat actors involved. The lack of specifics suggests a cautious approach to prevent further exploitation.
Comprehensive Security Updates for Pixel Devices
In addition to addressing CVE-2026-58704, Google rolled out a comprehensive security update for Pixel devices in September 2026, fixing a total of 109 vulnerabilities. Among these, 88 were related to privilege escalation, 10 to information disclosure, nine to remote code execution, and two to denial-of-service (DoS).
The update also included fixes for two other high-severity privilege escalation vulnerabilities in Kernel components, labeled CVE-2026-56914 and CVE-2026-58773. Furthermore, 46 critical vulnerabilities across various Pixel components were resolved, including those affecting BigOcean, Bootloader, IP Multimedia Subsystem, and Trusted Execution Environment.
Recommendations for Users
Google advises Pixel users to update their devices to the latest security patch level, 2026-09-05 or later, to protect against these vulnerabilities. Users can initiate the update by navigating to Settings > Security & privacy on their devices.
Earlier in June 2026, Google patched another high-severity flaw in Android’s Framework component, known as CVE-2025-48595, which had also been actively exploited. These continuous updates underscore the importance of regularly updating devices to maintain security.
As cybersecurity threats evolve, ensuring that devices are up-to-date with the latest patches is essential for safeguarding personal and sensitive information.
