Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Summary: Google disclosed a high-severity privilege escalation flaw in the Pixel Cellular Modem, tracked as CVE-2026-58704 with a CVSS score of 8.0, and said it found indications the bug may be under limited, targeted exploitation. The flaw is a logic error allowing a permission bypass that needs no user interaction, and Google's September 2026 Pixel updates address it along with 109 other flaws, including 46 critical-severity issues across components such as BigOcean, Bootloader, IP Multimedia Subsystem, and Trusted Execution Environment.
What you should know: CISA added CVE-2026-58704 to its KEV catalog on September 16, 2026, giving federal civilian agencies until September 19 to patch a zero-click modem flaw that can be triggered without the device owner doing anything.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-48595CVE-2026-56914CVE-2026-58704CVE-2026-58773
- Related
- CVE-2026-58704: Google Pixel Improper Authorization Vulnerability Known Exploited Vulnerabilities · Sep 16, 2026CVE-2025-48595: Android Framework Integer Overflow Vulnerability Known Exploited Vulnerabilities · Jun 02, 2026